752798 - File Disclosure on wiki.mozilla.org

Status: RESOLVED FIXED

(Websites :: wiki.mozilla.org, defect)

Description

[mike]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:12.0) Gecko/20100101 Firefox/12.0
Build ID: 20120423122928

Steps to reproduce:

https://wiki.mozilla.org/extensions/Bugzilla/pchart/examples/index.php?Action=1&Script=/etc/passwd

Here is the source code for the vulnerable file,  its the very first line:
https://wiki.mozilla.org/extensions/Bugzilla/pchart/examples/index.php?Action=1&Script=index.php


Actual results:

Read arbitrary files.

Comment 1

[mike]

Its more accurate to call this File Disclosure than Directory Traversal.  

PHP's highlight_file() function is dangerous:
http://php.net/manual/en/function.highlight-file.php

Comment 2

[Raymond Forbes[:rforbes]]

ayup, this

Comment 4

[chris hofmann]

mrz or corry can you get someone assigned to this.

Comment 5

[Chris More [:cmore]]

It appears that pchart charting software found here: http://www.pchart.net/download

We are running pchart 2.1.3 and that is the latest version. One quick fix would be to delete the "examples" directory. 

I would also do a grep on the file system like

find / -xdev -name "*.php" -type f -print0 | xargs -0 grep -H "highlight_file($Script)"

To see if there are other hightlight_file function calls on the system outside of the examples. It is very possible that the examples should have been deleted from a production system as it gives you the ability to see the working charting examples and the code behind the system.

Comment 6

[David Chan [:dchan]]

(In reply to Chris More [:cmore] from comment #5)
> It appears that pchart charting software found here:
> http://www.pchart.net/download
> 
> We are running pchart 2.1.3 and that is the latest version. One quick fix
> would be to delete the "examples" directory. 
> 

I did a quick grep of the code for files that used $_GET, $_REQUEST, $_POST. The only files that do are located in the examples directory. A shortterm solution appears to be deleting the examples directory as you mention.

A search for highlight only yielded files in examples as well.

Comment 7

[Jake Maul [:jakem]]

CC'ing the relevant developers to remove this code. I'm pretty sure this is deployed out of SVN or git or something.

Let us (webops) know when it's done and we'll re-push it.

Comment 8

[Lawrence Mandel [:lmandel] (use needinfo)]

Code lives in Git.

Brandon - Can you please handle the removal of the examples directory?

Comment 9

[Brandon Savage [:brandon]]

We can do that but it will not quickly resolve the problem. Please have IT disable the mediawiki-bugzilla plugin.

Comment 10

[Jake Maul [:jakem]]

I have manually deleted the pchart/examples directory, per comment 6. This should still be removed from the git repo, or it will re-appear whenever the code changes and we re-deploy it.

Comment 11

[Brandon Savage [:brandon]]

The examples directory is now gone from the repository on Github.

Would it be worthwhile to have pchart vetted by security for any other vulnerabilities?

Comment 12

[David Chan [:dchan]]

Brandon:

How prevalent is pchart is our current deployment? I can file a bug for pchart review, but our queue is long at this time.

Comment 13

[David Chan [:dchan]]

Closing bug off as RESOLVED due to directory being removed