Exploits / Vulnerability Discovered : 2019-01-07 |
Type : webapps |
Platform : php
This exploit / vulnerability Roxy fileman 1.4.5 unrestricted file upload / directory traversal is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
======================================================================
Exploit Title:: Multiple Vulnerabilities
Software: Roxy Fileman
Version: 1.4.5
Vendor Homepage: http://www.roxyfileman.com/
Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php
CVE number: CVE-2018-20525, CVE-2018-20526
Found: 2018-12-07
Tested on: PHP 7.0, Ubuntu 16.04 LTS
Author: Pongtorn Angsuchotmetee, Vittawat Masaree
SnoopBees Lab
https://www.snoopbees.com
=======================================================================
Description
===============================================================
Roxy Fileman is free open source file browser for .NET and PHP, ready for
use with CKEditor and TinyMCE WYSIWYG html editors. It could be easily
integrated into a CMS or any other web application. Fileman is based on
JQuery and JQueryUI libraries and it's compatible with all modern browsers
- Internet Explorer, Firefox, Google Chrome, Safary and Opera.
Roxy Fileman is designed to be as flexible as possible. The client
interface is completely separated from the server-side logic and scripts,
thus can be used with any server programming language - PHP, ASP .NET,
Python, Cold Fusion etc. All data exchanged including configuration and
language files is in light weight JSON format. Great performance - all data
from the server is loaded using Ajax without page reloading. Fileman has
ready to use distributions for PHP and .NET. All client-server
communications and configuration files are in JSON format and are language
independent. See custom server side scripts.
Ref: http://www.roxyfileman.com/
Proof of Concept
===========================
1) Path Traversal (CVE-2018-20525)
==================================
The vulnerability affected file “copydir.php", “copyfile.php",
“fileslist.php". It is we can manipulating variables that reference files
with “dot-dot-slash (../)” to access arbitrary files and directories
access on file system. After copied the system file will appear on Roxy
file manager “http://[IP-Address]/fileman/Uploads".
##############################################################
============================
2) Unrestricted File Upload (CVE-2018-20526)
==================================
The vulnerability affected file upload.php and in the condition that the
php.ini file need have add the “*AddHandler php7-script .php*”. And now we
can upload the shell code file to the server by double extension such
as *shellcode.php.png
*
Timeline
==================================
2018-12-07: Discovered the bug
2018-12-11: Reported to vendor (The vendor is unresponsive)
2018-12-19: Reported to vendor (The vendor is unresponsive)
2018-12-27: Request CVE
2019-01-03: Advisory published