Abysssec Inc Public Advisory


Title  : Portili Personal and Team Wiki Multiple Remote Vulnerabilities
Affected Version : Portili Personal and Team Wik   <= 1.14
Vendor  Site   : www.Portili.com

Discovery : www.Abysssec.com 

Vendor Contact  : 10/4/2009
Vendor Response : 11/4/2009

Vendor Response :


i have fixed all the vulnerabilities outlined and will release the fixes in the next version of the wiki.
The most troublesome vulnerabilities have come from the included ajaxfilemanager 3rd party image manager 
application (particularly in trying to integrate it with my own user authentication system). 
I'm planning to completely overhaul this at some point.



Description : 

this vulnerabites founded for a internal penetration testing project but now we decide to send vulnerabites to vendor. 
so there is no point to keep these private anymore these vulnerabities are just for educational purpose and author will 
be not be responsible for any damage using this vulnerabiltes .


Vulnerabilites : 


1- Admin Password Disclosure Exploit in ajaxfilemanager/ajax_save_name.php

Vulnerability : 

there an intersting vulnerability in this code . 


line 16-23

elseif(empty($_POST['name']))
	{
		$error = ERR_RENAME_EMPTY;
	}elseif(!preg_match("/^[a-zA-Z0-9 _\-.]+$/", $_POST['name']))
	{
		$error = ERR_RENAME_FORMAT;
	}elseif(empty($_POST['original_path']) || !file_exists($_POST['original_path']))
	



=======================================

line 39-68

	//update record of session if image exists in session for cut or copy
		include_once(CLASS_SESSION_ACTION);
		$sessionAction = new SessionAction();		
		$selectedDocuments = $sessionAction->get();
		if(removeTrailingSlash($sessionAction->getFolder()) == getParentPath($_POST['original_path']) && sizeof($selectedDocuments))
		{
			if(($key = array_search(basename($_POST['original_path']), $selectedDocuments)) !== false)
			{
				$selectedDocuments[$key] = $_POST['name'];
				$sessionAction->set($selectedDocuments);
				
			}
			
		}elseif(removeTrailingSlash($sessionAction->getFolder()) == removeTrailingSlash($_POST['original_path']))
		{
			$sessionAction->setFolder($_POST['original_path']);
		}	
		$path = addTrailingSlash(getParentPath($_POST['original_path'])) . $_POST['name'];
		if(is_file($path))
		{
			include_once(CLASS_FILE);
			$file = new file($path);
			$fileInfo = $file->getFileInfo();
		}else
		{
			include_once(CLASS_MANAGER);
			$manager = new manager($path, false);
			$fileInfo = $manager->getFolderInfo();
		}
	}

===============================================================================
there is two problem in code first is it won't check for logged user and next
is in the logic of this code . as you can see in code we can change any directory
even config directory so we can copy the config to uplods and then you can 
download the config file that contains user / pass of administrator .

PoC : http://vulnerable.com/ajaxfilemanager/ajax_save_name.php

POST: original_path=../application/config&name=uploads

now you can go and download the config .


Fast Solution : 

add this lines to first of ajax_save_name.php

        // ensure that only logged in users may access this script
	if (!file_exists('../authenticate_user.php')) { exit("couldn't locate the file authenticate_user.php"); }	//exit if the user authentication script cannot be found
	require_once('../authenticate_user.php');	//exit if the user is not authenticated by the codeigniter application




2- File Upload Vulnerability /Fckeditor

Vulnerability : 

Using Fckeditor without any authentication will give ability to attacker to 
upload his / her own file and fckeditor won't check file extention
it will give ability to attacker upload a malicius server side ASP / ASPX / PHP  / JSP .
so this vulnerability can creation access to server / portal completely .


PoC : http://www.vulnerable.com/fckeditor/editor/filemanager/connectors/test.html


3- Information Leakage in /phpinfo.php

Vulnerability: 

there is phpinfo.php can leak information about path and installation of web / php and 
disabled / enabled functions as well as extentions and modules .

PoC : http://www.vulnerable.com/phpinfo.php


4- Cross Site Scripting in ajaxfilemanager/ajaxfilemanager.php


Vulnerability :

after you logged in into the admin panel with a valid password
there is a uncheked variable named view .

line 49-61

	if(!empty($_GET['view']))
	{
		switch($_GET['view'])
		{
			case 'detail':
			case 'thumbnail':
				$view = $_GET['view'];
				break;
			default:
				$view = CONFIG_DEFAULT_VIEW;
		}
	}else 
	{
		$view = CONFIG_DEFAULT_VIEW;
	}

PoC  : http://vulnerable.com/ajaxfilemanager/ajaxfilemanager.php?path=../uploads/&view=1<script>alert("abysssec")</script>



feel free to contact me : admin [at] abysssec.com