PHPBB 2.0.16 Released (< 2.0.16 vulnerable)

Printable View

June 29th, 2005, 09:46 PM
nebulus200

PHPBB 2.0.16 Released (< 2.0.16 vulnerable)

Quote:

phpBB 2.0.16 Fixes a Critical Security Issue

If you're using the popular phpBB bulletin board package, it's time to upgrade. Version 2.0.16, released earlier this week, fixes a critical security issue that can lead to the compromise of the vulnerable web server. The problem is with the viewtopic.php script, which, according to the FrSIRT advisory, fails to properly validate input when processing the "highlight" parameter. A similar vulnerability was being exploited by the Santy worm to deface web sites about half a year ago, as we reported in the December 21, 2004 diary. Please update your copy of phpBB to help prevent another such worm from gaining steam.

For information about the phpBB 2.0.16 release, see the phpBB Group announcement. You can get the updated package from their downloads page. (Thanks to ISC reader Ronaldo for discussing the implications of this issue with us.)

(from http://www.incidents.org)

PHPBB group announcement: http://www.phpbb.com/phpBB/viewtopic.php?t=302011
July 1st, 2005, 07:05 AM
HTRegz

Hey Hey,

For those of you that are lazy, I had to update 6 sites that had the vulnerable viewtopic.php tonight... I've just applied their hotfix instead of the update... since it supposedly fixes the vuln...

I've added it here.... for those of you that don't want to update yourself.. just upload this one over top (it's from 2.0.15)... rename it to .php

Peace,
HT
July 1st, 2005, 11:24 AM
slarty

It appears to me that this vulnerability allows arbitrary PHP code execution on the server, hence is extremely serious.

I can see how that exploit works, and how such a thing could be missed by the coders. Illustrates the danger of ludicrously unreadable code such as this:

PHP Code:

// This was shamelessly 'borrowed' from volker at multiartstudio dot de // via php.net's annotated manual $message = str_replace('\"', '"', substr(preg_replace('#(\>(((?>([^><]+|(?R)))*)\<))#se', "preg_replace('#\b(" . $highlight_match . ")\b#i', '\\\\1', '\\0')", '>' . $message . '<'), 1, -1));

Not only is it extremely difficult to see what this does exactly, but it also happens to have this amazingly serious vulnerability

I *think* that the "e" modifier inside the preg_replace string "#se", means that the replaced string is evaluated as PHP code.

In fact this uses self-writing code, as the replacement

Code:

"preg_replace('#\b(" . $highlight_match . ")\b#i', '\\\\1', '\\0')", '>' . $message . '<'

Is itself a piece of PHP code, which of course can be trivially injected with PHP from $message

What a total nightmare.

Makes me wonder how exactly that was found - I certainly wouldn't have spotted it.

Slarty

PS: above may be entirely wrong, just my basic analysis.