We’re excited to announce that Bonsai Information Security has partnered with Rapid7! This partnership will allow our company to expand it’s market in north america by leveraging Rapid7’s impressive growth in the last years.
This partnership was possible because of our constant search for excellence, our customer need driven approach to consulting and our service quality. More deals like this, and Bonsai will be soon named Oak!
Recently, we’ve found an Open Redirection vulnerability in Twitter. To understand a little more about this, we can cite OWASP’s definition:
“An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.”
The following Proof of Concept was sent to the Twitter security team:
El día 30 de Junio de 2010 se llevó a cabo el OWASP Day en la sede de Paseo Colón de la Facultad de Ingeniería de la Universidad de Buenos Aires. Se realizaron charlas relacionadas con la Seguridad en Aplicaciones Web y otros aspectos relacionados a la Seguridad de la Información.
Bonsai Information Security participó siendo Sponsor y presentando a Nahuel Grisolía, Project Leader de Bonsai, como ponente en una de las charlas.
If you think that vulnerability research is only for computer geeks or hackers, you are wrong! Simple but effective “grep dorks” will be just fine to discover dirty pieces of code in, for example, PHP open source software.
Let’s focus on Cacti and use it as our case study as we’ve recently found its latest vulnerabilities using this technique. The next steps were followed to identify and exploit the latest Cacti OS commanding vulnerability found by our research team:
Download Cacti 0.8.7e
Uncompress Cacti
Under Cacti’s directory, find Operating System Function calls, such as “system”, “exec”, “shell_exec” or “popen”
$ grep –i –r “shell_exec(” *
The above command should result in some scripts using shell_exec PHP function
Edit one of those, for example, “lib/ping.php” and take a deeper look at it, near the OS call.
The function “ping_icmp” in “Net_Ping” class is using shell_exec function without sanitizing the host parameter. Uhmm… interesting!
Let’s see, where ping_icmp function is being called and let’s find out if we can manipulate hostname parameter in order to do our injection.
Note that in lib/ping.php, line 634, ping_icmp is being used inside the “ping” function.
Let’s search where Net_Ping is being used and where the ping function is being called and have a real look at the host parameter.
$ grep –i –r “net_ping” *
Ok! host.php script is using Net_Ping class, let’s have a deeper look again…
Line 625 in host.php script: note that the hostname is being used as a parameter, again, without sanitizing it.
So, if inside the application, you create a device (or host) with FQDN (without single quotes) ‘NotARealIPAddress;CMD;’, save it, and then, reload any data query, CMD will be executed with Web Server rights. More information on this, can be found in OS Commanding Injection in Cacti.
Eureka! 0day vulnerability found!
This is just an example of how some vulnerabilities might be identified and exploited using simple but effective techniques in real world applications.
You can also find other techniques to identify Web Application vulnerabilities, such as using Google’s code search. Consider revising this article and this blog post too.
In the context of the 7th International Congress of Information Security, Andrés Riancho was awarded with the Segurinfo award for his efforts in the development of w3af, and Open Source tool for identifying Web application vulnerabilities. We would like to congratulate him and the rest of the project contributors for this well deserved award!
En el contexto del séptimo Congreso Internacional de Seguridad de la Información, Andrés Riancho recibió el premio Segurinfo 2009 por sus esfuerzos en el desarrollo del software de detección de vulnerabilidades Web Open Source, w3af. Queremos felicitarlo y al resto de los desarrolladores del proyecto por un muy merecido premio.
We’re excited to announce that Bonsai Information Security has partnered with Rapid7! This partnership will allow our company to expand it’s market in north america by leveraging Rapid7’s impressive growth in the last years.
