Awesome
class.upload.php <= 2.0.3 Arbitrary file upload
- Author - Jinny Ramsmark
- Affected vendor - Verot.net
- Affected product - class.upload.php <= 2.0.3
- Tested on newly installed Ubuntu 19.10 with PHP7.3 and Apache/2.4.38
- Specifically Debian/Ubuntu has been found to be vulnerable since they add the php, phar, and phtml extensions to available PHP handlers. In this case class.upload.php has not blacklisted the phar extension.
Description
This is a filter bypass exploit that results in arbitrary file upload and remote code execution. The class.upload.php script filters "dangerous files and content" and renames them to the txt file extension. It also does different type of transformation on the uploaded image, which would normally destroy any injected payload, even if the file extension filter could be bypassed.
The file extension filter is a blacklist, so any time a new extension is introduced (in this case phar), or any has been missed, a PHP file can be uploaded. The content must still be a valid image however and will still go through the imagecreatefromjpeg and similar functions. For this purpose I wrote the inject.php script which will essentially bruteforce its way through different images until it finds one where the payload will not be destroyed by the process done in class.upload.php. This effectively gives us an arbitrary file upload and a very stealthy code execution since it's still a valid image and will be displayed like one on pages where uploaded.
Timeline (90 day default deadline)
- 2019-12-03 - Reported to developer and K2
- 2019-12-03 - K2 responded
- 2019-12-04 - Verot responded with a fix
- 2019-12-04 - K2 has responded with a prepared fix of their own
- 2019-12-04 - Verot has released said fix (v2.0.4)
- 2019-12-05 - Both parties have responded and agreed for information to be published
Files included in this PoC
- composer.json
- upload.php
- inject.php
Usage
The upload.php script is the example code from verot.net's github. I thought it would be best to demonstrate this vulnerability using their own example code.
- Run "php inject.php" in a terminal, it will generate a sample image with a simple payload in the file.
- When the script is finished it will produce a file called "image.jpg.phar".
- Browse to the upload.php file and upload image.jpg.phar, it will go through and you will now have a shell
Example
user@ayu:/var/www/html# php inject.php
-=Imagejpeg injector 1.7=-
[+] Fetching image (100 X 100) from http://lorempixel.com/100/100/
[+] Jumping to end byte
[+] Searching for valid injection point
[!] Temp solution, if you get a 'recoverable parse error' here, it means it probably failed
[+] It seems like it worked!
[+] Result file: image.jpg.phar
user@ayu:/var/www/html# curl -v -o - http://localhost/images/image_resized.phar?c=uname%20-a | grep -aPo "(Linux.*GNU)"
Linux ayu 5.0.0-36-generic #39-Ubuntu SMP Tue Nov 12 09:46:06 UTC 2019 x86_64 x86_64 x86_64 GNU
Proposed solution
- Don't blacklist file extensions.
- Use a whitelist of allowed ones by default instead.
- Or just don't have any extensions at all on uploaded files, and store the original name elsewhere.
Reference
Example attack in the Joomla K2 extension
Arbitrary file upload leading to remote code execution in JoomlaWorks K2 <= 2.10.1 due to unpatched version of class.upload.php
Website
Sample images
A regular user uploads the image generated by inject.php, containing a simple payload. It will bypass the extension filter in class.upload.php and not be destroyed by the image handling made in the library. It will render like a regular image, which is more subtle.
<kbd> <img src="/k2-1.png?raw=true"> </kbd>
The file will be uploaded and can be accessed as a backdoor and execute commands.