Re: [FSA016] ISPConfig 2.2.3, File inclusion vulnerability
Thank you for posting your ISPConfig code review.
The posted proof of concept exploit does not affect any ISPConfig installation.
Explanation:
There is one thing that you did not took in account while reviewing the sources:
You reviewed the installation tarball that is not identical with the resulting
system after installtion. The file, where the $go_info array is declared that
resulted in your errors is created by the installer. ISPCOnfig is not a web
application that is run in a normal PHP capable webspace, ISPConfig comes with
its own apache webserver and PHP specially compiled and configured for the
needs of ISPConfig that prevents the attacks you described.
Your review in detail with the explanation why the files are not affected.
---------------------------------------------------------------
Error occured in server.inc.php, line 35:
include_once($go_info["isp"]["classes_root"] .
$go_info["server"]["dir_trenner"] ."ispconfig_template.lib.php");
---------------------------------------------------------------
- The file server.inc.php is not inside the web root in
any ISPConfig installation.
---------------------------------------------------------------
Error occured in app.inc.php, line 48 - 49:
$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------
- The file server.inc.php is not inside the web root in
any ISPConfig installation.
- Additionally, the file contains a check in line 31 that
it is not executed when the file config.inc.php is not
included, where the $go_info variables are defined.
- Register globals is off in all ISPConfig installations.
---------------------------------------------------------------
Error occured in login.php, line 30 - 31:
$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------
- The file with the variable declaration of the $go_info array is
included in line 1.
- Register globals is off in all ISPConfig installations.
---------------------------------------------------------------
Error occured in trylogin.php, line 32 - 33:
$dbclass = $go_info["server"]["classes_root"] .
$go_info["server"]["dir_trenner"]
."ispconfig_db_".$go_info["server"]["db_type"].".lib.php";
include_once($dbclass);
---------------------------------------------------------------
- The file with the variable declaration of the $go_info array is
included in line 29.
- Register globals is off in all ISPConfig installations.