Open hackoclipse opened 4 years ago
cve assinged: CVE-2020-10567
Hello @hackoclipse, I am unabe to reproduce. Which version has this vulnerability? Regards
EDIT: It seems that older versions are not affected by this issue.
it still works in the newest version. and i think in version 9.13.4 it also work because one of my employers used that version when i repported this issue to them and got a shell on there servers. but the latest commit is a bit buggy but the backend has not been changed so it should still work in that version if you go to the dialog.php page and run the javascript on that page. you do need to install "php-mbstring" or the backend error's out with a error 500. you can find the location where it saves the file in the "upload_dir" what is also shown on the dialog.php page if you look with elemental inspect because that folder path can be different. sadly this issue never got fixed so i won't recommend using this software at all because it has more then only remote code execution issues. @joaovarelas
Hi @hackoclipse thanks for clarifying that. I confirm it works on latest version.
I was testing an older version and it did not work because the upload of data://
content was not introduced at that time yet.
However, it was possible to achieve remote code execution by uploading a malicious PHP file, bypassing the extension filter.
Regards
yeah im on the moment looking at the code and your right in 9.13.4 the code was a bit different and it checked for a aws bucket. i think it still has a issue if you can control your own aws bucket because it doesn't close the url. so you could give your own bucket. but it would be more tricky. but i would not recommend using this software because it also has internal ssrf what also affected version 9.13.4. https://github.com/trippo/ResponsiveFilemanager/issues/598
yeah im on the moment looking at the code and your right in 9.13.4 the code was a bit different and it checked for a aws bucket. i think it still has a issue if you can control your own aws bucket because it doesn't close the url. so you could give your own bucket. but it would be more tricky. but i would not recommend using this software because it also has internal ssrf what also affected version 9.13.4.
598
On versions <= 9.13.0 (at least) it is possible to upload files by specifying multipart/form-data
content type, setting the filename
to example.php<?.html
and the contents to <html><?php phpinfo();?>
.
There's also SSRF on url
parameter that allows to load internal files by using file://
URI scheme. (e.g. file://etc/passwd
).
yep thats why i won't reccomand using it at all. they don't really want to fix there issues.
your intresting @joaovarelas maybe you should join the bug bounty hunters server: https://discord.gg/bugbounty we have many famous pentesters/bughunters like todayisnew, insiderphd, bendtheory. https://hackerone.com/todayisnew?type=user https://twitter.com/insiderphd https://twitter.com/bendtheory and many others. you might fit well in the group. offcource only ethical hacking.
how you can inject php code to image file?
how you can inject php code to image file?
hello, I explored this some time ago, but I think it was uploading a HTML-crafted file with PHP code inside <html><?php phpinfo();?>
and using a filename file.php<?.html
.
how you can inject php code to image file?
hello, I explored this some time ago, but I think it was uploading a HTML-crafted file with PHP code inside
<html><?php phpinfo();?>
and using a filenamefile.php<?.html
.
is it work for version 9.14.0?
how you can inject php code to image file?
hello, I explored this some time ago, but I think it was uploading a HTML-crafted file with PHP code inside
<html><?php phpinfo();?>
and using a filenamefile.php<?.html
.
was a different one. they have so many and still haven't fixed this one... re'read the code it's still there. (last commit on that file May 3, 2019)
how you can inject php code to image file?
hello, I explored this some time ago, but I think it was uploading a HTML-crafted file with PHP code inside
<html><?php phpinfo();?>
and using a filenamefile.php<?.html
.was a different one. they have so many and still haven't fixed this one... re'read the code it's still there.
hi there, i've try your PoC and its work, but when i try use my payload php (not phpinfo) and then i injected the code to image file using exiftool and i encode the image using base64 encoder, but when i access my file contain php payload it getting 500 error. thank you sorry for my bad english
how you can inject php code to image file?
hello, I explored this some time ago, but I think it was uploading a HTML-crafted file with PHP code inside
<html><?php phpinfo();?>
and using a filenamefile.php<?.html
.was a different one. they have so many and still haven't fixed this one... re'read the code it's still there.
hi there, i've try your PoC and its work, but when i try use my payload php (not phpinfo) and then i injected the code to image file using exiftool and i encode the image using base64 encoder, but when i access my file contain php payload it getting 500 error. thank you sorry for my bad english
poc was minimized for a reason as anti script kiddie protection. it's complete or you did something wrong, wrong version or firewalls. can't risk exploitation this is good enough as poc for any bug bounty program.
Hello, I can add your telegram?
after taking another look at your application i noticed in the ajax_calls.php file in the "save_img" action that the "name" parameter doesn't validate the extension of the file. this makes it possible to upload php files to the server even when this normaly should not be allowed. there was a miner validation to check if the data from the "url" parameter started with "data:image/jpeg;base64," and that the base64 encoded image is a valid image. a simple work arround to bypass this check is to upload a valid jpeg image, but that inside of exif data a php tag is send. this makes it possible to send php code and that the extension becomes php what let to remote code execution.
As poc i will send a normal image where the base64 encoded image contains phpinfo() as php code. here is a simple javascript POC that will send a POST request to the page "http://192.168.0.29:3001/filemanager/ajax_calls.php?action=save_img" where the "path" parameters is empty, the url contains my image with phpinfo in the exif data and the name is set to poc.php. you will need to change the ip and port to your webserver and this code has to be runned on the filemanagers dialog.php page, because the session is validated and by running the code from the dialog page than the session is set and you won't get error's. if you run this command from the browsers console in the dialog page than a new file would be created in the /source/ folder called poc.php. ( UPLOAD_DIR ) than just go to "http://YOURURL/source/poc.php" and you will see the phpinfo() code executed.
here a copy of the burp request:
and here a copy of the image urldecoded:
A CVE has been requested and a potential fast patch is to dissable save_img in the config file.