Offsite avatar vulnerability

Posted: Fri Dec 16, 2005 12:20 pm

Here is a patch for the offsite avatar vulnerability.

First, create a backup of your original modules/Your_Account/index.php file.

Then,
Locate in modules/Your_Account/index.php around line 1525 (clean version 7.8 ) function avatarlinksave

Replace the entire avatarlinksave function with the following code ....

Code:

Save and upload. Very Happy

Site Admin Joined: Aug 17, 2003 Posts: 12397

I'm going to validate this and add to it - good job.

This line wasn't needed though. Smile

Code:

$avatar = $avatar;

And I'm not sure what this check is supposed to do

Code:

if (ereg("(http)", $avatar)) {

Because you already add http:// if its missing, that check should always be valid.

Next, the function needs to check that remote avatars are allowed.

Site Admin Joined: Aug 17, 2003 Posts: 12397

Your Account Avatar Validation Fix

Your Account does no validation to the avatar remote links and the avatar gallery selection. Nor does it even check that these avatars are allowed to be saved, per the configuration of the Forums. This may allow SQL injection and other nasty things.
(Avatar uploading itself is controlled by the Forums files.. which I assume has proper validation)

Issue and original fix credit to Prophet

MOD-FRIENDLY VERSION

IN modules/Your_Account/index.php

FIND

Code:

function avatarsave($avatar, $category) {
global $user_prefix, $db, $module_name, $user, $cookie;
if (is_user($user)) {

REPLACE WITH

Code:

function avatarsave($avatar, $category) {
global $user_prefix, $db, $module_name, $user, $cookie, $prefix;
$sql = "SELECT * FROM ".$prefix."_bbconfig WHERE config_name = 'allow_avatar_local'";
$result = $db->sql_query($sql);
if ($row = $db->sql_fetchrow($result))
{
$allow_avatar_local = $row['config_value'];
}
else { $allow_avatar_local = 0; }
if (is_user($user) AND $allow_avatar_local) {

FIND

Code:

$newavatar=$category."/".$avatar;

REPLACE WITH

Code:

   $category = stripslashes(check_html($category,"nohtml"));
   if(preg_match('/(\.gif$|\.png$|\.jpg|\.jpeg)$/is', $avatar) AND file_exists("modules/Forums/images/avatars/$category/$avatar"))
   {
   $newavatar = $category."/".$avatar;

FIND

Code:

CloseTable();
include("footer.php");

REPLACE WITH

Code:

} else {
 echo "<center>Error: Wrong avatar format! Avatars can only be gif, jpg, or png format. "._GOBACK."</center>";
 }
 CloseTable();
 include("footer.php");

FIND

Code:

function avatarlinksave($avatar) {
global $user_prefix, $db, $module_name, $user, $cookie;
if (is_user($user)) {

REPLACE WITH

Code:

function avatarlinksave($avatar) {
global $user_prefix, $db, $module_name, $user, $cookie, $prefix;
$sql = "SELECT * FROM ".$prefix."_bbconfig WHERE config_name = 'allow_avatar_remote'";
$result = $db->sql_query($sql);
if ($row = $db->sql_fetchrow($result))
{
$allow_avatar_remote = $row['config_value'];
}
else { $allow_avatar_remote = 0; }
if (is_user($user) AND $allow_avatar_remote) {

FIND

Code:

CloseTable();
OpenTable();

REPLACE WITH

Code:

   CloseTable();
   OpenTable();
   if( !preg_match("#^http:\/\/#i", $avatar) ){
   $avatar = "http://" . $avatar;}
   if(preg_match("#^(http:\/\/[a-z0-9\-]+?\.([a-z0-9\-]+\.)*[a-z]+\/.*?\.(gif|jpg|png)$)#is", $avatar) && !eregi(".php",$avatar) && !eregi(".js",$avatar) && !eregi(".cgi",$avatar)){

FIND

Code:

CloseTable();
include("footer.php");

REPLACE WITH

Code:

} else {
 echo "<center>Error: Wrong avatar format! Avatars can only be gif, jpg, or png format. "._GOBACK."</center>";
 }
 CloseTable();
 include("footer.php");

Site Admin Joined: Aug 17, 2003 Posts: 12397

If you have problems figuring out what to change, here's the visual version now that my ViewCVS is back up

http://evaders.swrebellion.com/modules.php?name=NukeWrap&page=cvsrepos/modules/Your_Account/index.php?only_with_tag=phpNuke76

Compare 1.4 and 1.3 - it will show you colored text of exactly where to put the code.

For the advanced user, you can use the CVS to compare to your current file and use diff as necessary

(Did I also mention you could Download the modified file directly as well. No editing needed on your part)

Lieutenant Joined: Sep 22, 2005 Posts: 204 Location: NYC

Thank You Prophet and Evaders99!! Cool

JoAnne ~

United Sound of Music

REEL SOUND of MUSIC

Nuke Soldier Joined: Apr 06, 2005 Posts: 25

You mention clean 7.8. Is 7.8.3.1 vulnerable as well?

Posted: Sun Dec 18, 2005 6:02 am

Any version of PHP-Nuke which allows the user to link to an offsite avatar via Your_Account module is vulnerable.
The best way to prevent an attack through the avatar linking is to simply disable the feature. However, since Your_Account module does not even check to see if the feature is enabled or disabled by the Admin, I still recommend patching the file.
The patch will not protect from every possible kind of attack because it only checks the link ... the data itself is not validated.
So, presently the only real fix is this ...
Find and replace the entire avatarlinksave function with ...

Code:

function avatarlinksave($avatar) {
include("header.php");
title("Disabled!");
OpenTable();
nav();
CloseTable();
OpenTable();
echo "Error: This feature is disabled!";
CloseTable();
include("footer.php");
}

That's in modules/Your_Account/index.php

Nuke Soldier Joined: Apr 06, 2005 Posts: 25

Great, thanks for the info!

Site Admin Joined: Aug 17, 2003 Posts: 12397

My code does indeed check whether it is allowed - per the configuration in your Forums. If that is not working, please verify it and tell me how I can duplicate it

You are correct that there are remote image problems. But that is not a specific phpNuke issue. Any site that allows remote links may have problems.

If there is a specific hack people are using, then please message them to me

Posted: Sun Dec 18, 2005 9:33 pm

Evaders99 wrote:

My code does indeed check whether it is allowed - per the configuration in your Forums.

Oh, I meant without any kind of patch Your_Account module does not check to see if the feature is enabled by the admin. I know you patched that.

Posted: Mon Dec 19, 2005 2:43 pm

I noticed a similar vulnerability in Your_Account edithome. Confused

Here's a fix ...

In modules/Your_Account/index.php

Find: (in the savehome function)

Code:

$ublock = FixQuotes($ublock);

Replace with:

Code:

$allowedTags='<a> <h1><h2><h3><h4>' .
'<li><ol><ul><table>' .
'<tr><td><th><ul>';
$ublock = strip_tags($ublock, $allowedTags);
$ublock = FixQuotes($ublock);

That takes care of that.

Site Admin Joined: Aug 17, 2003 Posts: 12397

Wouldn't we rather do

Code:

$ublock = FixQuotes(check_html($ublock,""));

That will use whatever is defined in the AllowedHTML in config.php

Posted: Tue Dec 20, 2005 9:51 pm

That'll work if it'll work for all versions. Very Happy

Site Admin Joined: Aug 17, 2003 Posts: 12397

More or less every version we need Smile

7.9 would use the filter function for that