full-disclosure-uk January 2009 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] Drupal Imagefield Modu

Re: [Full-disclosure] Drupal Imagefield Module Multiple Vulnerabilities

From: Justin C. Klein Keane <justin_at_nospam>
Date: Thu Jan 29 2009 - 16:57:58 GMT
To: Valdis.Kletnieks@vt.edu, full-disclosure@lists.grok.org.uk


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

  in one scenario you allow a Drupal 5.x user to administer content types - to set up new structures for node content. This permission doesn't allow the user to create content, to upload material, or to interact with the filesystem in any way. With the Imagefield module installed this user can move non-image files onto the filesystem. 'Administer content types' privilege only lets a user set up new structures for content nodes, not create content, or even upload material to the filesystem, except for the 'default image' used in the content type. The flaw allows such a user to upload any number of files, opening avenues to trigger local file inclusion vulnerabilities, hosting malware, phishing, etc., etc. The route to exploitation might be oblique, but ideally it shouldn't exist at all.

Justin C. Klein Keane
http://www.MadIrish.net

Valdis.Kletnieks@vt.edu wrote:
> On Thu, 29 Jan 2009 09:15:46 EST, "Justin C. Klein Keane" said:
>
>> Two flaws exist in this module. The first flaw allows for an attacker >> to upload arbitrary files to the filesystem. The vulnerability allows >> attackers to upload arbitrary files in place of the 'Default image' >> specified in the Imagefield specifications for a content type field.
> ....
>> Attackers must be authenticated with an account that has 'administer >> content types' permissions.
>
> Umm.. what's the risk here? Does the flaw allow the attacker to upload
> files that wouldn't be permitted even as the authorized account? Seems if
> they can administer content types, they can drop pretty much whatever they
> want onto the server (possibly limited as to where in the tree though), and
> all this does is let them drop stuff outside said tree?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQD1AwUBSYHgFpEpbGy7DdYAAQJCiQb+IluH+IhHZcvc3wNNsj2OrnZUUpS5jrpR 6inT0K6tExaH/hR2GQ7RzvFgC4iEgaRG6LbjqSC004q0wBrzM4/heS7QUPyL5PN5 uJXefyC/NJQNjKhaZ+0viC6fccwlbO72eTyghe6VzTHYN4IdiMwjB/cV62zZFBeA n5ZPjqr61e7NGg20dZW7IigpjJjA4YJke2P3naYwKTgns5RY/yMjFYRJr1WA3fXt 0vRXKbERw1RHsgiwHxEAHG8uOgfMF5hncDCpSYw2fvSkIONvEhi5a4wWksHou3VH SKn2WjZLvT4=
=GiiR
-----END PGP SIGNATURE-----



Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/