<<< Date Index >>>     <<< Thread Index >>>

Gallery 2.x Security Advisory




Gallery is an open source web based photo album organizer.  The
2.x is a newly released complete rewrite of the application.

   Url: http://gallery.menalto.com
   Contact: gallery@xxxxxxxxxxx

An internal security audit turned up 3 separate vulnerabilities. These are all resolved in Gallery 2.0.2, released on 11/28/2005 and available
here:

   http://codex.gallery2.org/index.php/Gallery2:Download

Vulnerabilities:

1. The installer records information in an install log that is stored in the gallery data directory. An attacker can discover the location of this directory and read this file to discover information about the Gallery installation. The Gallery installer recommends that you put the gallery data directory outside of your webserver's document root, and allows you to name this directory anything that you choose, however if the user may choose to put it in an obvious place. Site administrators can delete this file by hand to disarm the flaw.

2. The "Add Image From Web" feature is vulnerable to executing javascript embedded inside <img> tags on the target page and can be exploited via XSS that way. This requires the attacker to trick the a Gallery user into loading images from that page.

3. The zipcart module, if installed and activated can be used to view any files on the webserver that are visible to the webserver user. Gallery is delivered in 4 flavors (minimal, typical, full, developer). The zipcart module is not included in the minimal or typical packages. It is also not installed by default. It must be manually selected for install and activation by the Gallery site administrator. Site administrators can deactivate this module to disarm the flaw.

Vulnerable:
   Gallery 2.0.1       (all flaws)
   Gallery 2.0         (all flaws)
   Gallery 2.0 RC 2    (all flaws)
   Gallery 2.0 RC 1    (all flaws)
   Gallery 2.0 Beta 3  (xss and zipcart flaws only)
   Gallery 2.0 Beta 2  (xss and zipcart flaws only)
   Gallery 2.0 Beta 1  (xss and zipcart flaws only)
   Gallery 2.0 Alpha 4 (xss and zipcart flaws only)
   Gallery 2.0 Alpha 3 (xss and zipcart flaws only)
   Gallery 2.0 Alpha 2 (xss flaw only)
   Gallery 2.0 Alpha 1 (xss flaw only)
   CVS HEAD before 2005-11-26

Not Vulnerable:
   Gallery 1 (all versions)
   Gallery Remote (all versions)