> Vulnerabilities in EGroupware 1.8.005
> Discovered by Pedro Ribeiro (pedrib@gmail.com) of Agile Information Security
====================================================================
Vulnerability: PHP object insertion leading to all kinds of badness (arbitrary file deletion, possible code execution) (CVE-2014-2027)
File(line): egroupware/addressbook/csv_import.php(257,258)
File(line): egroupware/calendar/csv_import.php(277,278)
File(line): egroupware/projectmanager/csv_import.php(324,325)
File(line): egroupware/infolog/csv_import.php(336,337)
File(line): egroupware/preferences/inc/class.uiaclprefs.inc.php(108)
Code snippet:
egroupware/addressbook/csv_import.php(257,258):
case 'next':
$_POST['addr_fields'] = unserialize(stripslashes($_POST['addr_fields']));
$_POST['trans'] = unserialize(stripslashes($_POST['trans']));
egroupware/calendar/csv_import.php(277,278):
case 'next':
$_POST['cal_fields'] = unserialize(stripslashes($_POST['cal_fields']));
$_POST['trans'] = unserialize(stripslashes($_POST['trans']));
egroupware/projectmanager/csv_import.php(324,325):
egroupware/infolog/csv_import.php(336,337):
case 'next':
$_POST['info_fields'] = unserialize(stripslashes($_POST['info_fields']));
$_POST['trans'] = unserialize(stripslashes($_POST['trans']));
egroupware/preferences/inc/class.uiaclprefs.inc.php(108):
if ($_POST['save'] || $_POST['apply'])
{
$processed = $_POST['processed'];
$to_remove = unserialize(urldecode($processed));
Arbitrary file overwrite in __destruct:
egroupware/etemplate/inc/class.etemplate_request_files.inc.php
140 function __destruct()
141 {
142 if ($this->remove_if_not_modified && !$this->data_modified)
143 {
144 //error_log(__METHOD__."() destroying $this->id");
145 @unlink(self::$directory.'/'.$this->id);
146 }
147 elseif (!$this->destroyed && $this->data_modified &&
148 !file_put_contents($filename = self::$directory.'/'.$this->id,serialize($this->data)))
149 {
150 error_log("Error opening '$filename' to store the etemplate request data!");
151 }
152 }
Comment:
User input is passed directly into unserialize(), leading to object insertion, arbitrary file deletion and possible code execution.
There are lots of classes with exploitable magic methods, and the above is just an example.
References:
https://www.owasp.org/index.php/PHP_Object_Injection
http://www.alertlogic.com/writing-exploits-for-exotic-bug-classes/
http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf
http://vagosec.org/2013/12/wordpress-rce-exploit/
