phpBB Attachment Mod Multiple Extensions File Uploading Vulnerability
Posted on 17 December 2004
From: <advisory(at)stgsecurity.com>
STG Security Advisory: [SSA-20041215-18]
Revision 1.1
Date Published: 2004-12-15 (KST)
Last Update: 2004-12-15
Disclosed by SSR Team (advisory@stgsecurity.com)
Summary
========
phpBB Attachment Mod is file upload module for phpBB. However, an input validation flaw can cause malicious attackers to run arbitrary commands with the privilege of the HTTPD process, which is typically run as the nobody user.
Vulnerability Class
===================
Implementation Error: Input validation flaw
Impact
======
High : arbitrary command execution.
Affected Products
================
Attachment Mod 2.3.10 and prior.
Vendor Status: FIXED
====================
2004-12-08 Vulnerability found.
2004-12-08 Attachment Mod developer notified.
2004-12-13 Update version released.
2004-12-15 Official release.
Details
=======
Attachment Mod doesn't implemented to check multiple extensions of uploaded files, e.g. attack.php.rar, so malicious attackers can upload arbitrary script files (php, pl, cgi, etc) to a web server. This is originated from a feature of Apache MIME module (mod_mime), which regards attack.php.rar as a normal PHP file and execute the file through mod_php module with the privilege of the HTTPD process.
cf.
[Only Registered and Activated Users Can See Links. Click Here To Register...] - "Files with Multiple Extensions" : it's a feature, not a bug.
Solution
=========
Update to 2.3.11
[Only Registered and Activated Users Can See Links. Click Here To Register...]