Search | Research | Contact Us Friday March 2, 2022
Languages
Most Viewed Items
  1 PHPXMLRPC Library Remote Code Execution
  2 Multiple Invision Power Board Vulnerabilities
  3 XOOPS 2.0.11 && Earlier Multiple Vulnerabilities
  4 Mambo Multiple Vulnerabilities
  5 PEAR XML_RPC Library Remote Code Execution
  6 eBay And Amazon Still Vulnerable
  7 Woltlab Burning Board SQL Injection Vulnerability
  8 When Small Mistakes Can Cause Big Problems
  9 WordPress 1.5.1.2 And Earlier Multiple Vulnerabilities
10 MySQL Eventum Multiple Vulnerabilities
Need Secure Code?
Quick Search
You can use the form below to search our site. Just enter the keywords to search.
Home Services Archives Research Downloads Contact
eyeOS Remote Code Execution
February 7, 2022
Vendor : eyeOS Project
URL : http://www.eyeos.org/
Version : eyeOS <= 0.8.9
Risk : Remote Code Execution


Description:
eyeOS is a "web based operating system" written in php, that lets you access your data and your applications from anywhere with an internet connection. There is a very easy to exploit Remote Code Execution issue in one of the core eyeOS files that affects eyeOS 0.8.9 and earlier. A new version of eyeOS has been released and all users are encouraged to upgrade immediately to eyeOS 0.8.10


Remote Code Execution:
There is a Remote Code Execution vulnerability in eyeOS that is the result of improperly initializing users sessions.
if (!isset ($_SESSION))
     session_start ();

The above code is taken from desktop.php @ lines 20-21 and is the reason code execution is possible. The $_SESSION array is just like any other variable until initialized with session_start() unless session.auto_start is set to 1. What's even worse is that obviously an attacker does not have to authenticate in order to exploit this issue, which makes it that much more dangerous.

http://eyeOS/desktop.php?baccio=eyeOptions.eyeapp&a;=eyeOptions.eyeapp &_SESSION[usr]=demo&_SESSION[apps][eyeOptions.eyeapp][wrapup]=phpinfo();

The above url will successfully execute the phpinfo() command on the target webserver with privileges of the webserver.


Solution:
A new version of eyeOS (eyeOS v0.8.10) is now available at the official eyeOS website. Users are encouraged to upgrade as soon as possible.


Credits:
James Bercegay of the GulfTech Security Research Team