Drupal Local File Inclusion Vulnerability (Windows)
Hi guys,
I was testing Acunetix WVS (with AcuSensor enabled) on Drupal
(http://www.drupal.org) and the scanner found a possible File Inclusion
vulnerability. The vulnerability is located in the file
"includes\theme.inc" on line 1011.
Vulnerable code:
function theme_render_template($template_file, $variables) {
extract($variables, EXTR_SKIP); // Extract the variables to a local
namespace
ob_start(); // Start output buffering
include "./$template_file"; // Include the template file <<< here
is the vulnerability
$contents = ob_get_contents(); // Get the contents of the buffer
ob_end_clean(); // End buffering and discard
return $contents; // Return the contents
}
Basically, by manipulating the q variable, it's possible to partially
control the include path. The GET variable q was set to
"start/../../xxx\..\..\end" and it got partially sanitized.
It reached the include function as
"./themes/garland/page-start-..-..-xxx\..\..\end.tpl.php".
All the slashes were replaced with "-".
Even more, we cannot fully control the include path, the user input is
automatically prefixed with "./themes/garland/page-".
So, this vulnerability doesn't look exploitable, right?
Actually, this is exploitable, but only on Windows systems.
On Unix systems, something like "cat
/var/www/some_invalid_filename/../../../../../etc/passwd" doesn't work
because some_invalid_filename is not a directory.
It will not work even if you have a valid filename in there. In my
opinion this is the expected behavior.
However, on Windows things are differently.
Executing the command "type
c:\windows\sssssssssssss\..\..\..\..\..\boot.ini" will return the
contents of
c:\boot.ini even if sssssssssssss is not a directory and it doesn't even
exists as a filename.
PHP option magic_quotes_gpc is turned OFF in Drupal, so it's possible to
use %00 to terminate the string.
Therefore, if you set q to something like
q=\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini%00 it's possible to
include the contents of boot.ini on Windows systems (if the web server
is installed on the C: partition).
A bit more information is available in our blog at
http://www.acunetix.com/blog/websecuritynews/drupal-local-file-inclusion-vulnerability/.
Drupal security team was notified about this vulnerability on 29 January
2009 and they've released a fix on 25 February 2009.
The fix for Drupal versions 5.x is available at
http://drupal.org/node/384024.
And for Drupal versions 6.x can be found at http://drupal.org/node/383724.
Thanks and have a nice day,
--
Bogdan Calin - bogdan@xxxxxxxxxxxx
CTO
Acunetix Ltd. - http://www.acunetix.com
Acunetix Web Security Blog - http://www.acunetix.com/blog