Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web BBS :: etc :: hack7201.htm

JSBoard uploading files with multiple extensions



STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files with multiple extensions in JSBoard



STG Security Advisory: [SSA-20041215-17] Vulnerability of uploading files

with multiple extensions in JSBoard



Revision 1.0

Date Published: 2004-12-15 (KST)

Last Update: 2004-12-15

Disclosed by SSR Team (advisory@stgsecurity.com) 



Summary

========

JSBoard is one of widely used web BBS applications in Korea.  However, an

input validation flaw can cause malicious attackers to run arbitrary

commands with the privilege of the HTTPD process, which is typically run as

the nobody user.



Vulnerability Class

===================

Implementation Error: Input validation flaw



Impact

======

High : arbitrary command execution.



Affected Products

================

JSBoard 2.0.8 and prior.

JSBoard 1.3.11 and prior.



Vendor Status: FIXED

====================

2004-12-08 Vulnerability found.

2004-12-08 JSBoard developer notified.

2004-12-09 Update version released.

2004-12-15 Official release.



Details

=======

JSBoard doesn't implemented in "include/parse.php" to check multiple

extensions of uploaded files, e.g. attack.php.hwp, so malicious attackers

can upload arbitrary script files (php, pl, cgi, etc) to a web server. This

is originated from a feature of Apache MIME module (mod_mime), which regards

attack.php.hwp as a normal PHP file and execute the file through mod_php

module with the privilege of the HTTPD process.



cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple

Extensions" : it's a feature, not a bug.



Solution

=========

JSBoard 2.x branch : Update to 2.0.9

http://kldp.net/frs/download.php/1670/jsboard-2.0.9.tar.gz 



JSBoard 1.x branch : Update to 1.3.13

http://kldp.net/frs/download.php/1668/jsboard-1.3.13.tar.gz 



Vendor URL

==========

http://kldp.net/projects/jsboard/ 



Credits

======

Jeremy Bae at STG Security


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH