620134 - Arbitrary PHP Execution on getpersonas.com

Status: RESOLVED FIXED

(Websites Graveyard :: getpersonas.com, defect)

Description

[Neal Poole]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Build Identifier: 

This is the same vulnerability as Bug 619467, using JPEGs/PNGs instead of GIFs. I created one JPEG and one PNG, each of the proper size for upload to getpersonas.com. I then renamed them to .php and was able to upload them without any need to mess around with LiveHTTPHeaders. I was also able to guess their path on the server (the URLs are predictable: not a bad thing, but it helped me out here, since I could visit the page even before my theme was approved).

https://www.getpersonas.com/pending/3/0/345330/trans.php
https://www.getpersonas.com/pending/3/0/345330/new-trans.php

Reproducible: Always

Comment 1

[David Chan [:dchan]]

Verified. The upload_form code only performs an identify command on the file. The image should be converted with -strip.

http://viewvc.svn.mozilla.org/vc/projects/getpersonas.com/trunk/server/upload_forms.php?view=markup

Will file blocker for same fix as bug 619467

Comment 2

[Neal Poole]

Attachment: PNG image with embedded PHP

Attaching the images I used (1/2). All I needed to do was change their file extension to .php.

Comment 3

[Neal Poole]

Attachment: JPEG image with embedded PHP

Attaching the images I used (2/2). All I needed to do was change their file extension to .php.

Comment 4

[David Chan [:dchan]]

The issue should be resolved. Thanks for reporting it. I imagine the people in charge of the web bounty will update this bug when they can.

Comment 5

[David Chan [:dchan]]

I'll file a bug for a client-side fix later

Comment 6

[David Chan [:dchan]]

app-layer not client side. need some coffee

Comment 7

[David Chan [:dchan]]

Re-open for app-layer fix.
Bug #620455

Comment 9

[Wil Clouser [:clouserw]]

I'm not sure why bug 620455 was filed, but either it is a dupe of this one or vice versa.  Since I've got that one assigned to a developer, I'm going to reclose this.