Description:
eyeOS is a "web based operating system" written in php, that lets you
access your data and your applications from anywhere with an internet
connection. There is a very easy to exploit Remote Code Execution
issue in one of the core eyeOS files that affects eyeOS 0.8.9 and
earlier. A new version of eyeOS has been released and all users are
encouraged to upgrade immediately to eyeOS 0.8.10
Remote Code Execution:
There is a Remote Code Execution vulnerability in eyeOS that is the
result of improperly initializing users sessions.
if (!isset ($_SESSION))
session_start ();
The above code is taken from desktop.php @ lines 20-21 and is the
reason code execution is possible. The $_SESSION array is just like
any other variable until initialized with session_start() unless
session.auto_start is set to 1. What's even worse is that obviously
an attacker does not have to authenticate in order to exploit this
issue, which makes it that much more dangerous.
http://eyeOS/desktop.php?baccio=eyeOptions.eyeapp&a;=eyeOptions.eyeapp
&_SESSION[usr]=demo&_SESSION[apps][eyeOptions.eyeapp][wrapup]=phpinfo();
The above url will successfully execute the phpinfo() command on
the target webserver with privileges of the webserver.
Solution:
A new version of eyeOS (eyeOS v0.8.10) is now available at the official
eyeOS website. Users are encouraged to upgrade as soon as possible.
Credits:
James Bercegay of the GulfTech Security Research Team
|
