{"id":39,"date":"2021-06-15T00:26:41","date_gmt":"2021-06-15T00:26:41","guid":{"rendered":"https:\/\/securereality.com.au\/?page_id=39"},"modified":"2021-06-15T00:39:41","modified_gmt":"2021-06-15T00:39:41","slug":"security-advice-3","status":"publish","type":"page","link":"https:\/\/securereality.com.au\/security-advice-3\/","title":{"rendered":"Security Advice #3"},"content":{"rendered":"\n

You can view a plain text version of this advisory\u00a0here<\/a>

Released<\/strong>
12\/09\/2000

Vulnerable<\/strong>
Most (all?) versions of IMP < 2.2.1

Overview<\/strong>
IMP is an extremely powerful and widespread webmail application in PHP. In investigating the PHP file upload issue discussed in SRADV0001 we tested many popular PHP scripts which supported file upload. All of them were vulnerable to the problem in the form given, except IMP. By luck it managed to avoid this problem, it is however still vulnerable to arbitrary disclosure of files readable by the web user (typically ‘nobody’) via an alternative method.

Shame we released this advisory a little late, for those not aware a serious bug has been found in Horde (a library that IMP uses) that allows remote command execution. This means most users will (hopefully) have updated at least the Horde library to the latest version, however, those who only updated the Horde library and not IMP in addition will be vulnerable to this problem.

Impact<\/strong>
File disclosure

Detail<\/strong>
IMP is not vulnerable to most forms of the method described in SRADV00001 because it to copy the specified file to its current location with .att appended. That is, if the filename were ‘\/etc\/passwd’, it attempts to copy the file to ‘\/etc\/passwd.att’. This will almost always fail, since the web user is unlikely to have access to write files in the directories specified.

However, IMP makes the mistake of storing hidden variables in a form which if modified can cause insecure behaviour. In order to keep track of the attachments for an email being composed in compose.php, it stores in the form variables like the following:
&lt;input type=”hidden” name=”attachments_name[]” value=”hello.txt”&gt; &lt;input type=”hidden” name=”attachments_size[]” value=”68″&gt; &lt;input type=”hidden” name=”attachments_file[]” value=”\/var\/tmp\/phpAAA0kwGF6.att”&gt; &lt;input type=”hidden” name=”attachments_type[]” value=”text\/plain”&gt; Modifying the attachments_name[] hidden variable will cause IMP to email as an attachment any file it can read with web user privleges. Additionally it will try to unlink this file once complete, which could potentially be used to cause damage.<\/p>\n\n\n\n

Fix<\/strong>
Please upgrade to the latest versions:
IMP 2.2.1 at\u00a0ftp:\/\/ftp.horde.org\/pub\/imp\/<\/a>
Horde 1.2.1 at\u00a0ftp:\/\/ftp.horde.org\/pub\/horde\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

You can view a plain text version of this advisory\u00a0here Released12\/09\/2000 VulnerableMost (all?) versions of IMP < 2.2.1 OverviewIMP is an extremely powerful and widespread webmail application in PHP. In investigating the PHP file upload issue discussed in SRADV0001 we tested many popular PHP scripts which supported file upload. All of them were vulnerable to … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_generate-full-width-content":""},"_links":{"self":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/39"}],"collection":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/comments?post=39"}],"version-history":[{"count":0,"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/pages\/39\/revisions"}],"wp:attachment":[{"href":"https:\/\/securereality.com.au\/wp-json\/wp\/v2\/media?parent=39"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}