Тема: Уязвимость в моде Automatic Image Upload with Thumbnails 1.3.4
Предисторию упущу. Сразу к делу!
Описание уязвимости:
Description:
Peter Österberg has discovered a vulnerability in the Automatic Image Upload with Thumbnails module for PunBB, which can be exploited by malicious users to conduct cross-site scripting attacks and to compromise a vulnerable system.The uploadimg.php script fails to validate the extension of an uploaded file. This can be exploited to upload files with ".html" or ".php" extensions by passing an allowed MIME media type in the HTTP headers.
Successful exploitation allows to conduct cross-site scripting attacks or to execute arbitrary PHP code on the server, but requires valid user credentials in a group that is allowed to upload files.
The vulnerability is confirmed in version 1.3.3 and reported in version 1.3.2. Other versions may also be affected.
Solution:
Implement whitelisting based on file extensions in uploaded files.Grant only trusted users privileges to upload files.
[right]secunia.com/advisories/28138[/right]
проверено лично -- в 1.3.4 эта дырка присутствует (хотя версия на панресе была опубликована позже чем было последнее обновление информации об этой уязвимости afaik).
а теперь собственно простейший солюшен который избавит от проблемы. открываем uploadimg.php и ищем строку (~193):
// Determine whether file is correct filetype-
if (!((($_FILES['imagefile']['type'] == "image/jpg" || $_FILES['imagefile']['type'] == "image/jpeg" || $_FILES['imagefile']['type'] == "image/pjpeg") && ($allow_jpg_uploads == "1")) || (($_FILES['imagefile']['type'] == "image/png" || $_FILES['imagefile']['type'] == "image/x-png") && ($allow_png_uploads == "1")) || (($_FILES['imagefile']['type'] == "image/gif") && ($allow_gif_uploads == "1"))))добавляем проверку расширения файлов:
if (!((($_FILES['imagefile']['type'] == "image/jpg" || $_FILES['imagefile']['type'] == "image/jpeg" || $_FILES['imagefile']['type'] == "image/pjpeg") && ($imagefilename_ext == 'jpg' || $imagefilename_ext == 'jpeg') && ($allow_jpg_uploads == "1")) || (($_FILES['imagefile']['type'] == "image/png" || $_FILES['imagefile']['type'] == "image/x-png") && ($imagefilename_ext == 'png') && ($allow_png_uploads == "1")) || (($_FILES['imagefile']['type'] == "image/gif") && ($imagefilename_ext == 'gif') && ($allow_gif_uploads == "1"))))собственно и всё. пошаговую инструкцию о том как использовать эту уязвимость не публикую -- во избежание попадания готовой к употреблению информации в плохие руки 
з.ы. предупрежден -- вооружен!
[img]http://lokee.rv.ua/lastfm.np/lastfm-np.php[/img]
