mirror of
https://github.com/Piwigo/Piwigo.git
synced 2026-11-03 07:22:22 +01:00
Cross Site Scripting in image upload. #551
Assignees
adam (Adam Wojcieszonek)
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: adam/Piwigo#551
Reference in new issue
Block a user
Latest Version of piwigo is vulnerable to cross site scripting vulnerability in the image upload function,
The filename of image can be crafted with malicious payload,which in turn executes while viewing the image.
HTTP REQUEST:
POST /piwigo2/piwigo2/ws.php?method=pwg.images.upload&format=json HTTP/1.1
Host: x.x.x.x:xxxx
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://x.x.x.x:xxxx/piwigo2/piwigo2/admin.php?page=photos_add
Content-Length: 437474
Content-Type: multipart/form-data; boundary=---------------------------2133695097524014491600710750
Cookie: pwg_id=5bcim9rvd29i0grbe3qqg4qlk4; PHPSESSID=8e7766b7fc68cc81ee8cb8858dba1b1e; cid=1; wordpress_logged_in_8812ad623e46a1e5ebc36bb4a144d4be=admin%7C1484115709%7CSYNChB5ZsITQYFlPiW5bspgix97gGEwr05932gvtGtp%7Cda8b8a3479779d07c9d1759a52b8e52a7168da7170b66a093ff5ea93a09ec453
Connection: close
-----------------------------2133695097524014491600710750
Content-Disposition: form-data; name="name"
test
-----------------------------2133695097524014491600710750
Content-Disposition: form-data; name="chunk"
0
-----------------------------2133695097524014491600710750
Content-Disposition: form-data; name="chunks"
1
-----------------------------2133695097524014491600710750
Content-Disposition: form-data; name="category"
1
-----------------------------2133695097524014491600710750
Content-Disposition: form-data; name="level"
0
-----------------------------2133695097524014491600710750
Content-Disposition: form-data; name="pwg_token"
d0cc011709eb9b873188071ab872ebe7
-----------------------------2133695097524014491600710750
Content-Disposition: form-data; name="file"; filename="payloadhere.png"
Content-Type: image/png
Malicious script can be passed in the payloadhere section
Hi @boogyman2 can you please send me an email with more details? "plg" /at/ "piwigo.org"
Hello
I'm the one with the lowest skill here ; so you need to be
1- to be logged as admin
2- to send a picture through an home made POST request just like the one at admin.php?page=photos_add
3- but I don't get the final step
Hi @plegall yea sure,I'll put up a mail.
@plegall Mail sent,with details.Check it out.
up?
Hi, @flop25 No Response from @plegall yet, i had sent him a an email explaining the vulnerability.
you up ? @plegall
I admit I don't really like to modify the original filename.
If you use the web upload form, you execute the javascript in file name, but it is not "stored", so it's not a real problem.
Maybe it's enough to check during upload that the given filename does not
contain < > (invalid for both Windows /Linux)
On Jan 27, 2017 11:16, "Pierrick Le Gall" notifications@github.com wrote:
@plegall the xss is stored one..A victim viewing the image with payload itself is necessary to infect him/her. What if an attacker uplaods the crafted image and sends victim the link. Suggestion by @modus75 is good one to consider.
"<" is valid in filename on Linux :-/ One thing really nice on the upload form, compared to FTP synchronization, is that you have no constraint on filename.
@boogyman2 The current solution, using htmlentities before registering in database, prevents from stored XSS.
@plegall okey pleg,am not much of a development guy,so i'll leave choice of choosing the better solution to you :) . Can you grab me a CVE for this?
Usually, the reporter gives us the CVE, not the opposite :-)
Use the CVE Id , CVE-2017-5608