KL-001-2024-001: Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

2024-3-6 02:29:9 Author: seclists.org(查看原文) 阅读量:15 收藏

KL-001-2024-001: Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

Title: Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability
Advisory ID: KL-001-2024-001
Publication Date: 2024.03.05
Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-001.txt

1. Vulnerability Details

     Affected Vendor: Artica
     Affected Product: Artica Proxy
     Affected Version: 4.40 and 4.50
     Platform: Debian 10 LTS
     CWE Classification: CWE-23: Relative Path Traversal
     CVE ID: CVE-2024-2053

2. Vulnerability Description

     The Artica Proxy administrative web application attempts to
     prevent local file inclusion. These protections can be bypassed
     and arbitrary file requests supplied by unauthenticated
     users will be returned according to the privileges of the
     "www-data" user.

3. Technical Description

     Prior to authentication, a user can send an HTTP request to
     the "images.listener.php" endpoint. This endpoint processes
     the "mailattach" query parameter and concatonates the user
     supplied value to the "/opt/artica/share/www/attachments/"
     file path. The contents of the file located at the newly
     created path is returned in the HTTP response body.

     The "images.listener.php" endpoint attempts to prevent
     a local file inclusion vulnerability by stripping strings
     that attempt to traverse into the parent directory from
     the user supplied "mailattach" value:

$_GET["mailattach"]=str_replace("////","/",$_GET["mailattach"]);
$_GET["mailattach"]=str_replace("///","/",$_GET["mailattach"]);
$_GET["mailattach"]=str_replace("//","/",$_GET["mailattach"]);
$_GET["mailattach"]=str_replace("../","",$_GET["mailattach"]);
$_GET["mailattach"]=str_replace("/etc/","",$_GET["mailattach"]);
$_GET["mailattach"]=str_replace("passwd","",$_GET["mailattach"]);
$file="/opt/artica/share/www/attachments/{$_GET["mailattach"]}";
       header("Content-type: application/force-download" );
       header("Content-Disposition: attachment; \
               filename=\"{$_GET["mailattach"]}\"");
       header("Content-Length: ".filesize($file)."" );
       header("Expires: 0" );
       readfile($file);

     If effective, this approach would limit files
     accessible by this endpoint to those within the
     "/opt/artica/share/www/attachments/" directory. Unfortunately,
     the removal of the "../" string is only performed once, so
     the resulting file path is not checked.  By using the path
     "..././foo.txt", the "images.listener.php" endpoint removes the
     "../" string resulting in "../foo.txt" - a relative file path
     to traverse to the parent directory.

     The strings "/etc/" and "passwd" are also stripped from the file
     path as many methods of detecting a path traversal vulnerability
     rely on fetching the "/etc/passwd" file. By inserting these
     strings into specific locations, a user suppplied "mailattach"
     value such as "/epasswdtc/ppasswdasswd" is transformed into
     "/etc/passwd", bypassing the protection entirely.

     An unauthenticated user can leverage this endpoint to read
     files on the system, according to the privileges of the
     "www-data" user.

4. Mitigation and Remediation Recommendation

     No response from vendor; no remediation available.

5. Credit

     This vulnerability was discovered by Jaggar Henry of KoreLogic,
     Inc.

6. Disclosure Timeline

     2023.12.18 - KoreLogic requests vulnerability contact and
                  secure communication method from Artica.
     2023.12.18 - Artica Support issues automated ticket #1703011342
                  promising follow-up from a human.
     2024.01.10 - KoreLogic again requests vulnerability contact and
                  secure communication method from Artica.
     2024.01.10 - KoreLogic mail daemon receives SMTP 554 5.7.1 from
                  mail.articatech.com with response
                  "Client host rejected: Go Away!"
     2024.01.11 - KoreLogic requests vulnerability contact and
                  secure communication method via
                  https://www.articatech.com/ 'Contact Us' web form.
     2024.01.23 - KoreLogic requests CVE from MITRE.
     2024.01.23 - MITRE issues automated ticket #1591692 promising
                  follow-up from a human.
     2024.02.01 - 30 business days have elapsed since KoreLogic
                  attempted to contact the vendor.
     2024.02.06 - KoreLogic requests update on CVE from MITRE.
     2024.02.15 - KoreLogic requests update on CVE from MITRE.
     2024.02.22 - KoreLogic reaches out to alternate CNA for
                  CVE identifiers.
     2024.02.26 - 45 business days have elapsed since KoreLogic
                  attempted to contact the vendor.
     2024.02.29 - Vulnerability details presented to AHA!
                  (takeonme.org) by proxy.
     2024.03.01 - AHA! issues CVE-2024-2053 to track this
                  vulnerability.
     2024.03.05 - KoreLogic public disclosure.

7. Proof of Concept

Full Disclosure mailing list archives

Current thread: