Skip to content
A penetration testing tool for finding file upload bugs (NDSS 2020)
Python Other
  1. Python 99.3%
  2. Other 0.7%
Branch: master
Clone or download

Latest commit

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
configs Remove new line Feb 24, 2020
mutation_op Release Feb 24, 2020
resource Release Feb 24, 2020
seed Release Feb 24, 2020
tester Release Feb 24, 2020
.gitignore Release Feb 24, 2020
README.md Add summary of the obtained CVEs Mar 12, 2020
filemonitor.py Release Feb 24, 2020
filemutator.py Release Feb 24, 2020
fileuploader.py Release Feb 24, 2020
framework.py Release Feb 24, 2020
rabbitmq.py Release Feb 24, 2020
requirements.txt Fix typo Mar 10, 2020
utils.py Release Feb 24, 2020

README.md

FUSE

FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.

Setup

Install

FUSE currently works on Ubuntu 18.04 and Python 2.7.15.

  1. Install dependencies
# apt-get install rabbitmq-server
# apt-get install python-pip
# apt-get install git
  1. Clone and build FUSE
$ git clone https://github.com/WSP-LAB/FUSE
$ pip install -r requirement.txt
  • If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document.

Usage

Configuration

  • FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files.

  • Configuration for File Monitor (Optional)

$ vim filemonitor.py

...
 10 MONITOR_PATH='/var/www/html/' <- Web root of the target application
 11 MONITOR_PORT=20174            <- Default port of File Monitor
 12 EVENT_LIST_LIMITATION=8000    <- Maxium number of elements in EVENT_LIST
...

Execution

  • FUSE
$ python framework.py [Path of configuration file]
  • File Monitor
$ python filemonitor.py
  • Result
    • When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.
    • A [HOST] folder stores files that have been attempted to upload.
    • A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.

CVEs

If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md

Application CVEs
Elgg CVE-2018-19172
ECCube3 CVE-2018-18637
CMSMadeSimple CVE-2018-19419, CVE-2018-18574
CMSimple CVE-2018-19062
Concrete5 CVE-2018-19146
GetSimpleCMS CVE-2018-19420, CVE-2018-19421
Subrion CVE-2018-19422
OsCommerce2 CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966
Monstra CVE-2018-6383, CVE-2018-18694
XE XEVE-2019-001

Author

This research project has been conducted by WSP Lab at KAIST.

Citing FUSE

To cite our paper:

@INPROCEEDINGS{lee:ndss:2020,
    author = {Taekjin Lee and Seongil Wi and Suyoung Lee and Sooel Son},
    title = {{FUSE}: Finding File Upload Bugs via Penetration Testing},
    booktitle = {Proceedings of the Network and Distributed System Security Symposium},
    year = 2020
}
You can’t perform that action at this time.