YaBB 2.5.2 and earlier arbitrary code execution

Yet another Bulletin Board (YaBB) 2.5.2 and earlier allow arbitrary
code execution through a combination of file uploads with
predictable locations and unsanitized use of the "guestlanguage"
cookie in file paths.

This problem is similar to CVE-2007-3295.


References:

http://www.yabbforum.com/community/YaBB.pl?num=1367511332

http://www.carsten-dalgaard.dk/cgi-bin/yabb2/YaBB.pl?num=1367511256


In Load.pl find:

CodeSelect All

if ($yyCookies{'guestlanguage'} && !$FORM{'guestlang'} && $enable_guestlanguage) {
$language = $guestLang = $yyCookies{'guestlanguage'};
}
 



replace with:
CodeSelect All

    if (   $yyCookies{'guestlanguage'}
        && !$FORM{'guestlang'}
        && $enable_guestlanguage )
    {   opendir DIR, $langdir;
        my @langDir = readdir DIR;
        closedir DIR;
        @lang = ();
        foreach my $langitems ( sort { lc($a) cmp lc $b } @langDir ) {
            chomp $langitems;
            if (   ( $langitems ne q{.} )
                && ( $langitems ne q{..} )
                && ( $langitems ne q{.htaccess} )
                && ( $langitems ne q{index.html} ) )
            {
                push @lang, $langitems;
            }
        }

        $ccheck = 0;
        $clang = q{};
        for my $lng (@lang) {
           if ( $yyCookies{'guestlanguage'} eq $lng ) {
               $clang = $lng;
               $ccheck = 1; last;
           }
        }
        if ($ccheck == 1) {
$language = $guestLang = $clang;
        }
}
 



And I'm sure Carsten will have a much neater way of doing this.

While I can't confirm that the security vulnerability has ever been exploited against a YaBB Forum, I'm pretty sure that the original code allows for the possibility of bad stuff being passed into the $language variable - which is a very bad thing.

The new code compares what's in the guestlanguage cookie against the possible valid options - the Languages in the Language folder on the server.  If it's not a valid value, it doesn't get passed along. (At least that's how it should work.) 

Copyright ©2024 Exploitalert.