Home page logo

bugtraq logo Bugtraq mailing list archives

DPGS allows any file to be overwritten
From: "b0iler " <b0iler () eyeonsecurity net>
Date: Fri, 21 Jun 2002 22:59:35 -0700

Taken from the scripts website:
"WARNING: DPGS is no longer maintained and is thus discontinued. If you would like to take over its development, email 
me. - July 30, 2000"

This is the reasoning to why I did not contact the author prior to this email.

This is an example of how bad input filtering and open() based on user input make a nasty combo.

the script is Duma Photo Gallery System and in update.dpgs lies the problem open():

open(DATABASE, ">$path_to_members/$FORM{'id'}/data.txt")
        || &error("Couldn't  write $path_to_members/$FORM{'id'}/data.txt");
while ( ($form_key, $form_value) = each(%FORM) ) {
        print DATABASE "$form_key$delimiter$form_value\n" unless
                ( $form_value eq '' || $form_key eq "id" || $form_key =~ "password" );

this will open the database of this user and then try to add data to the database.  Now 
here is what %FORM is filtered by in DPGS.pll:

        $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
        $value =~ s/<([^>]|\n)*>//g;
        $value =~ s/<!--(.|\n)*-->//g;  #removes any server side includes
        $value =~ s/^\s+//;     #remove any leading spaces
        $value =~ s/\s+$//; #remove any trailing spaces
        $value =~ s/$delimiter//g; #remove delimiters if any.
        $value =~ s/\"/\&quot\;/g; #replace quotes with &quot;
        $value =~ s/\r\n/<BR>/g; #replace new line characters with <BR>
        $FORM{$name} = $value;
none of these stop directory transversal or the null byte.  So if we sign up with an id of ../../etc/passwd\0 then the 
/etc/passwd file will be the one opened for writting.  We can write to any file this way, even overwritting other 
user's data.txt files or 
the admin data file '../admin'.

No fix is on hand, but feel free to come up with your own.  Filter for null bytes and reverse directory 

b0iler - http://b0iler.eyeonsecurity.net

make sure to check out http://b0iler.eyeonsecurity.net/tutorials/hackingcgi.htm for a great paper on perl cgi security 
and exploitation.  Many new methods of exploiting common perl cgi code.  Including the s/<!--(.|\n)*-->//g; "filter" 
which is used in this script and thousands of others.

  By Date           By Thread  

Current thread:
  • DPGS allows any file to be overwritten b0iler (Jun 21)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]