1364253 - Unauthorized access to run DB queries in https://arewefastyet.com/regressions folder

Status: RESOLVED FIXED

(Websites :: Other, defect)

Description

[Vladimir Metnew]

As described here: https://blog.mozilla.org/security/2017/05/11/relaunching-web-bug-bounty-program/ arewefastyet.com is very important app for Mozilla team.

Sources for this project are avaliable on Github: https://github.com/mozilla/arewefastyet/blob/2696cbea7fbbe50c3a8cbf70a0ac3c70f135852e/website/regressions/data-revision.php#L17 

Repro:
Get request to https://arewefastyet.com/regressions/data-revision.php - you can see that mysql throws error.
Make a post request with fields like:
{
	"mode":1,
	"rev":" LIMIT 2-- ",
	"machine": "\"1",
	"id": "\"1"
} 
leads to request execution, so malformed sql commands can be passed inside required fields.

Look at  this line https://github.com/mozilla/arewefastyet/blob/2696cbea7fbbe50c3a8cbf70a0ac3c70f135852e/website/regressions/data-revision.php#L17

You can find `preg_replace` function, but according to this post https://stackoverflow.com/questions/3115559/exploitable-php-functions preg_replace at first executes passed parameters. And $rev field from json isn't sanitized, so we can pass PHP's commands into $rev param to execute commands.

Comment 1

[Vladimir Metnew]

it looks like it's a problem with auth. This script doesn't call has_permission() function as other php scripts in repo. Like this: 
https://github.com/mozilla/arewefastyet/blob/2696cbea7fbbe50c3a8cbf70a0ac3c70f135852e/website/regressions/change-bug.php#L10-L11

Comment 2

[Vladimir Metnew]

Guys, I just found that other scripts in this folder are vulnerable too. Example: https://arewefastyet.com/regressions/data-score.php (SQLi)

Comment 3

[Vladimir Metnew]

+ data-submit.php in this folder

Comment 4

[Vladimir Metnew]

+ data-search.php

Comment 5

[Vladimir Metnew]

Sorry, maybe I need to separate this report into few reports for ever vulnerability? (no auth protection on few endpoints, RCE, few SQLIs )

Comment 6

[Vladimir Metnew]

Sorry, for all these comments, I need to say that there is no RCE and SQLi on these resource. Sorry for the panic.
But unauthorized user is allowed to run php files in this folder that don't call has_permission() function. As I understand it's a bug, because unauthorized user shouldn't have access to run these files.

Comment 7

[Greg G]

Thanks for the report vladimirmetnew.

+garndt: are missing permission checks data-submit.php, data-search.php, data-revision.php or are unauthed users allowed to access them?

Comment 8

[Greg Arndt [:garndt]]

Hrm, I do not recall working on areweslimyet.  Do you mean someone else?

Comment 9

[Greg Arndt [:garndt]]

sorry, I mean arewefastyet...same applies though :)

Comment 10

[Greg G]

-garndt

+h4writer,dvander: are we missing permission checks on data-submit.php, data-search.php, data-revision.php or are unauthed users allowed to access them?

Comment 11

[David Anderson [:dvander] - inactive, e-mail if emergency]

Hannes is no longer at Mozilla. I think bbouvier handles AWFY now.

Comment 12

[Benjamin Bouvier [:bbouvier] (inactive)]

(In reply to Vladimir Metnew from comment #6)
> Sorry, for all these comments, I need to say that there is no RCE and SQLi
> on these resource. Sorry for the panic.
> But unauthorized user is allowed to run php files in this folder that don't
> call has_permission() function. As I understand it's a bug, because
> unauthorized user shouldn't have access to run these files.

Agreed with this: inputs are sanitized anyways, so there's no risk of RCE (the /e modifiers in preg_replace isn't used) nor SQLi (inputs are sanitized).

I'll add signin guards to these pages.

Comment 13

[Benjamin Bouvier [:bbouvier] (inactive)]

Fixed by https://github.com/mozilla/arewefastyet/commit/443bba25a8523fbde868d6239789690307cd52f0, now most pages are behind a sign-in page.

Thanks for the report, once again!

Comment 14

[Greg G]

Thanks Ben and Vladimir!

Comment 15

[April King [:April]]

This site is not eligible for a bug bounty payout, but it is eligible for our Hall of Fame.  How would you liked to be credited on our hall of fame, including URL?

Thanks!

Comment 16

[Vladimir Metnew]

Yes, thanks for HoF, name: Vladimir Metnew, url: https://github.com/Metnew .