Subrion allows to upload pht, phar extensions.

[Hexife]

Brief of this vulnerability
In uploading process, Subrion allows to upload pht, phar files. There are able to execute as PHP script following server environment.

Test Environment

• Apache/2.4.18 (Debian)
• PHP 5.6.38-2+ubuntu16.04.1+deb.sury.org+1 (cli)

Affect version
4.2.1

Payload

1. move to http://[address]:[port]/[app_path]/panel/uploads with admin credential

2. Save php codes with pht or phar extensions. and upload it like below.

# test.pht
<?php system(id);?>

3. Right Click and Open the uploaded file name or
   move to http://[address]:[port]/[app_path]/uploads/[uploaded file].

4. Profit!

Reason of This Vulnerability
Subrion has .htaccess file for preventing execution of uploaded file.

# Deny files access for some file extensions
<FilesMatch "(?i)\.(php|php5|php4|php3|php2|phtml|pl|py|jsp|asp|htm|shtml|sh|cgi)$">
    ForceType text/plain
    Order Deny,Allow
    Deny from All
</FilesMatch>

# Process script files as plain text
AddHandler default-handler .php .php5 .php4 .php3 .php2 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi

In upload directory, .htaccess did not prevent execution of the files that have the pht and phar extensions. As a result, they are able to execute as PHP script.

I tested the pht extensions because my test environment is PHP 5.6, so mod_php can not execute phar extension scripts as PHP. But If Subrion installed in PHP 7.2+ envrionment, phar extension is also able to execute as PHP.

[Hexife]

Note: php7 extension was also able to upload, but it could not executable because of .htaccess placed in app root.

[Hexife]

I got the CVE Numbers for this vulnerability - CVE-2018-19422.

[vbezruchkin]

Hi,

Thanks for your report. Could you please explain the first step?

move to http://[address]:[port]/[app_path]/panel/uploads with admin credential

What would be the idea to upload files if you have admin login details? Sounds a bit useless. All the frontend upload fields are validated and there is no way to upload files being logged in as non-admin.

Thanks

[Hexife]

I glad to see your comment 😄

Before the start to write the answer for your comment, I didn't understand the point of your questions exactly, so this comment might not be the enough answer for yours. 😭

If this comment is not answered for your question, please comment me about the details of your question.

First step means - Login as the user who can use the upload feature, and move to the upload pages ( admin panel / content / uploads ).

I found this vulnerability in the upload feature and the user needed the admin details for using this feature.

Main problem of this vulnerability was from lack of the blacklist in the .htaccess.
(I didn't think it was intended behavior, because other php-executable extension was already blocked in the .htaccess)

So, I think the account problems (stolen admin details or session etc..) should consider as only the requirements for triggering this vulnerability.

(In other words, the account problem can affect to decrease the severity of this vulnerability.
But it can't be countermeasure this problem.)

Thanks!

[vbezruchkin]

Thanks for the report. Yes, the note sounds indeed reasonable - we will definitely modify .htaccess and exclude php-executables within uploads/ folder.
Anyhow, we all understand the admin should be careful about the feature that allows to manage files within directory. The system still should be manually tuned when it comes to admin panel functionality.
For example we have a functionality that allows to create/edit blocks with php content, and this part might be also very dangerous. Admins should clearly understand what they allow and what's permitted.

[Hexife]

I agree with your words. 😄

Admin panel might have some management features even they are dangerous.

It is intended features.
(I think that one of the important point to vulnerability is that the behavior is intended or not.)

Therefore, misuse of the dangerous feature without other vulnerability( e.g. XSS ) is not the vulnerability of the feature.

It is just the permission management fail.

Thank you!

[vbezruchkin]

Thanks. Added to the version now.