Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard
From: "SSR Team" <advisory () stgsecurity com>
Date: Thu, 16 Dec 2004 10:17:41 +0900

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files
with multiple extensions in JSBoard

Revision 1.0
Date Published: 2004-12-15 (KST)
Last Update: 2004-12-15
Disclosed by SSR Team (advisory () stgsecurity com)

Summary
========
JSBoard is one of widely used web BBS applications in Korea.  However, an
input validation flaw can cause malicious attackers to run arbitrary
commands with the privilege of the HTTPD process, which is typically run as
the nobody user.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
JSBoard 2.0.8 and prior.
JSBoard 1.3.11 and prior.

Vendor Status: FIXED
====================
2004-12-08 Vulnerability found.
2004-12-08 JSBoard developer notified.
2004-12-09 Update version released.
2004-12-15 Official release.

Details
=======
JSBoard doesn't implemented in "include/parse.php" to check multiple
extensions of uploaded files, e.g. attack.php.hwp, so malicious attackers
can upload arbitrary script files (php, pl, cgi, etc) to a web server. This
is originated from a feature of Apache MIME module (mod_mime), which regards
attack.php.hwp as a normal PHP file and execute the file through mod_php
module with the privilege of the HTTPD process.

cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple
Extensions" : it's a feature, not a bug.

Solution
=========
JSBoard 2.x branch : Update to 2.0.9
http://kldp.net/frs/download.php/1670/jsboard-2.0.9.tar.gz

JSBoard 1.x branch : Update to 1.3.13
http://kldp.net/frs/download.php/1668/jsboard-1.3.13.tar.gz

Vendor URL
==========
http://kldp.net/projects/jsboard/

Credits
======
Jeremy Bae at STG Security

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQcDiAD9dVHd/hpsuEQKY8gCg2vJZ2akGDGEA//Hwi3rOheZaVwkAn31V
tYi5XHLsUOHHdENvCrsUZyPi
=3VGj
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


  By Date           By Thread  

Current thread:
  • STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard SSR Team (Dec 18)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault