Search | Research | Contact Us Monday February 5, 2022
Languages
Most Viewed Items
  1 PHPXMLRPC Library Remote Code Execution
  2 Multiple Invision Power Board Vulnerabilities
  3 XOOPS 2.0.11 && Earlier Multiple Vulnerabilities
  4 Mambo Multiple Vulnerabilities
  5 PEAR XML_RPC Library Remote Code Execution
  6 eBay And Amazon Still Vulnerable
  7 Woltlab Burning Board SQL Injection Vulnerability
  8 WordPress 1.5.1.2 And Earlier Multiple Vulnerabilities
  9 When Small Mistakes Can Cause Big Problems
10 MySQL Eventum Multiple Vulnerabilities
Need Secure Code?
Quick Search
You can use the form below to search our site. Just enter the keywords to search.
Home Services Archives Research Downloads Contact
PEAR XML_RPC Library Remote Code Execution
July 01, 2022
Vendor : The PEAR Group
URL : http://pear.php.net/package/XML_RPC/
Version : PEAR XML_RPC 1.3.0 && Earlier
Risk : Remote Code Execution


Description:
PEAR XML_RPC is a PHP implementation of the XML-RPC web RPC protocol, and used by many different developers across the world. PEAR XML_RPC was originally developed by Edd Dumbill of Useful Information Company, but has since been expanded by several individuals. Unfortunately PEAR XML_RPC is vulnerable to a remote php code execution vulnerability that may allow for an attacker to compromise a vulnerable server. Version 1.3.1 has been released to address these issues.


Remote Command Execution:
PEAR XML_RPC is vulnerable to a very high risk php code injection vulnerability due to unsanatized data being passed into an eval() call. Let us have a look at the code that allows the vulnerability to present itself.
// decompose incoming XML into request structure
xml_parser_set_option($parser_resource, XML_OPTION_CASE_FOLDING, true);
xml_set_element_handler($parser_resource, 'XML_RPC_se', 'XML_RPC_ee');
xml_set_character_data_handler($parser_resource, 'XML_RPC_cd');
if (!xml_parse($parser_resource, $data, 1)) {
    // return XML error as a faultCode
    $r = new XML_RPC_Response(0,
                              $XML_RPC_errxml+xml_get_error_code($parser_resource),
                              sprintf('XML error: %s at line %d',
                                      xml_error_string(xml_get_error_code($parser_resource)),
                                      xml_get_current_line_number($parser_resource)));
    xml_parser_free($parser_resource);
} else {
    xml_parser_free($parser_resource);
    $m = new XML_RPC_Message($XML_RPC_xh[$parser]['method']);
    // now add parameters in
    for ($i = 0; $i < sizeof($XML_RPC_xh[$parser]['params']); $i++) {
        // print '\n";
        $plist .= "$i - " . $XML_RPC_xh[$parser]['params'][$i] . " \n";
        eval('$m->addParam(' . $XML_RPC_xh[$parser]['params'][$i] . ');');
    }
    XML_RPC_Server_debugmsg($plist);

The for() loop that holds the vulnerable eval() call is used to build the request from an incoming POST containing an XML document. There is really no type of checks or sanitation done prior to this point, and the fact that magic_quotes_gpc does not apply makes it that much easier for this issue to be exploited.
<?xml version="1.0"?>
<methodCall>
<methodName>test.method</methodName>
	<params>
		<param>
		<value><name>','')); phpinfo(); exit;/*</name></value>
		</param>
	</params>
</methodCall>

The above xml file when posted to the vulnerable server will cause the phpinfo() function call to be executed on the vulnerable server.


Solution:
PEAR XML_RPC 1.3.1 has been released to address this issue and can be found at

http://pear.php.net/package/XML_RPC/download/1.3.1

Both users and developers alike are strongly advised to upgrade immediately!


Credits:
James Bercegay of the GulfTech Security Research Team