FCKeditor ADS File Upload Vulnerability - Windows Only

Posted on Monday, June 18, 2007 @ 15:38:59 PDT in Security
by Raven

SECUNIA ADVISORY ID: SA25719

VERIFY ADVISORY: http://secunia.com/advisories/25719/

CRITICAL: Moderately critical

IMPACT: Security Bypass

WHERE: >From remote

SOFTWARE: FCKeditor 2.x - http://secunia.com/product/7973/

DESCRIPTION: A vulnerability has been discovered in FCKeditor, which can be exploited by malicious people to bypass certain security restrictions.


The vulnerability is caused due to an error in the file upload functionality. This can be exploited to bypass the file extension filter and upload files with arbitrary extensions by using the NTFS Alternate Data Stream (ADS) as the filename, e.g. "file.php::$DATA". Successful exploitation requires that an NTFS file system is used and that file uploads have been enabled in the "config.php" configuration file (not enabled by default). The vulnerability is confirmed in version 2.4.3 using the PHP file uploader.

SOLUTION: Disable file uploads in config.php. Grant only trusted user access to the application.

PROVIDED AND/OR DISCOVERED BY: Michael Schramm

ORIGINAL ADVISORY: http://ha.ckers.org/blog/20070606/additional-image-bypass-on-windows/
 
 
click Related        click Share
 
 

Re: FCKeditor ADS File Upload Vulnerability - Windows Only (Score: 1)
by kguske on Tuesday, June 19, 2007 @ 08:03:50 PDT

(User Info | Send a Message)

Although this was tested in version 2.4.3 (released 6/14/2007) , it shouldn't affect RavenNuke users using nukeWYSIWYG (currently using version 2.3.2) as uploads are only allowed for admins.

On the subject of 2.4.3, there are a few (literally 3) enhancements and a slew of fixes in this version. We hope to evaluate this version (or a corrected version to address this reported vulnerability) soon.

 
 

Re: FCKeditor ADS File Upload Vulnerability - Windows Only (Score: 1)
by redhairz on Tuesday, June 26, 2007 @ 16:40:15 PDT

(User Info | Send a Message)

hi kguske sorry to trouble you, can you check for me? cos i am using rn with the 2.2 that comes in the Experimental folder of the rnnuke is that safe?

 
News ©

Donate o Meter

Help Keep Our Server Online AND Our Services Free!
Make donations with PayPal!
Donations
 

Site Info v2.2.2

Server TrafficServer Traffic
  • Total: 269,440,849
  • Today: 44,391
Server InfoServer Info
  • Oct 23, 2014
  • 12:51 pm PDT
 
 

Daily Inspiration