Local File Inclusion in Firebrand Technologies CMS (2010)

What this paper is

This paper details a Local File Inclusion (LFI) vulnerability found in older versions of the Firebrand Technologies Content Management System (CMS). An LFI vulnerability allows an attacker to trick a web application into including and executing files from the server's local filesystem that it was not intended to access. In this specific case, the vulnerability can be exploited to read sensitive files like /etc/passwd.

Simple technical breakdown

The vulnerability lies in how the web application handles user-supplied input for the module parameter in its index.php script. Instead of properly sanitizing or validating this input, the application directly uses it to construct a file path. By providing a path that traverses up the directory structure (using ../../) and then specifies a target file (like /etc/passwd), an attacker can force the server to read and display the content of that file. The null byte (%00) is used to terminate the string, preventing the application from appending any default extension it might expect.

Complete code and payload walkthrough

The provided paper is very concise and does not contain any code or payload in the traditional sense of a script or binary. It only describes the vulnerability and provides an example URL.

• Vulnerability Description:

  • The paper states the vulnerability is a "Local File Inclusion" in "CMS Firebrand Tec".
  • It identifies the affected script as index.php.
  • It points to the module parameter as the vector for the exploit.

• Exploit Example URL:

  • http://localhost/path/index.php?module=../../../../../../../../../../../../../../../etc/passwd%00
  • http://localhost/path/index.php: This is the target URL, pointing to the index.php script of the Firebrand Technologies CMS.
  • ?module=: This indicates the start of the query string, where the module parameter is being set.
  • ../../../../../../../../../../../../../../../: This sequence of directory traversal characters (../) is used repeatedly to move up the directory hierarchy on the server. The large number of ../ suggests that the attacker needs to go up many levels to reach the server's root directory.
  • etc/passwd: This is the target file to be included. /etc/passwd is a standard Linux/Unix file that contains user account information.
  • %00: This is the URL-encoded representation of the null byte character. In many programming languages, a null byte signifies the end of a string. By appending it, the attacker can truncate the filename processing, preventing the application from adding any expected file extension (e.g., .php or .html) to the path, ensuring that only /etc/passwd is considered.

• Mapping:

  • index.php?module= -> Web application script and parameter susceptible to manipulation.
  • ../../../../../../../../../../../../../../../ -> Directory traversal sequence to reach the server's root.
  • etc/passwd -> Target file for inclusion.
  • %00 -> Null byte to terminate string processing and bypass potential extension appending.

There is no shellcode or payload in this paper. The "exploit" is simply a specially crafted URL that leverages the application's insecure handling of the module parameter to read a file.

Practical details for offensive operations teams

• Required Access Level: Network access to the target web server. No prior authentication or elevated privileges on the web application are typically required for this type of LFI.
• Lab Preconditions:
  • A vulnerable instance of Firebrand Technologies CMS (V.1.x) deployed on a web server.
  • Knowledge of the web server's directory structure to estimate the number of ../ needed.
  • A web server environment that allows reading of sensitive files like /etc/passwd.
• Tooling Assumptions:
  • A web browser for manual testing.
  • A web proxy (e.g., Burp Suite, OWASP ZAP) to intercept and modify requests.
  • Automated vulnerability scanners might be configured to test for LFI, but manual verification is crucial.
  • Command-line tools like curl for scripting and testing.
• Execution Pitfalls:
  • Incorrect Path Traversal Count: Too few ../ will result in including a file within the web application's directory, not the target system file. Too many might also cause errors.
  • Null Byte Issues: Some web server configurations or PHP versions might handle null bytes differently, potentially rendering the %00 ineffective. Alternative null byte encodings or techniques might be needed.
  • File Permissions: The web server's user account must have read permissions for the target file (e.g., /etc/passwd).
  • Web Application Firewall (WAF): Modern WAFs can detect and block common LFI patterns like directory traversal sequences.
  • Input Sanitization: If the CMS has been patched or updated, input sanitization might prevent this specific exploit.
• Tradecraft Considerations:
  • Reconnaissance: Identify the target application and its version. Use search engines (dorks) to find potential targets.
  • Enumeration: Understand the web server's file system structure to tailor the ../ count.
  • Payload Delivery: For LFI, the "payload" is the content of the file read. If the goal is to execute code, LFI can be a stepping stone to upload a malicious file or include a file that contains malicious PHP code.
  • Stealth: LFI requests can appear as legitimate traffic if not excessively repetitive or using obvious patterns. However, repeated requests for sensitive files might trigger IDS/IPS.

Where this was used and when

• Context: This vulnerability was identified and published in 2010. It was likely exploited against websites running the Firebrand Technologies CMS, specifically version 1.x.
• Timeframe: The exploit was published on April 25, 2010. Exploitation would have occurred around this time and potentially for some period afterward until the software was patched or updated.

Defensive lessons for modern teams

• Input Validation and Sanitization: Always validate and sanitize all user-supplied input, especially parameters used in file path construction. Never trust user input.
• Principle of Least Privilege: Ensure the web server process runs with the minimum necessary file system permissions. It should not have read access to sensitive system files.
• Secure File Inclusion Practices: If file inclusion is a necessary feature, use whitelisting of allowed files or directories. Avoid using user input directly in file paths.
• Regular Patching and Updates: Keep all web applications and their components updated to the latest secure versions.
• Web Application Firewalls (WAFs): Deploy and configure WAFs to detect and block common attack patterns, including LFI attempts.
• Security Audits and Code Reviews: Regularly audit code for common vulnerabilities like LFI, SQLi, XSS, etc.

ASCII visual (if applicable)

This vulnerability is a direct interaction between the attacker's request and the server's file system via the web application.

+-----------------+      +------------------------+      +-----------------+
| Attacker's URL  | ---> | Web Server (index.php) | ---> | Server's Filesystem |
| (e.g., /etc/passwd) |      | (Vulnerable Code)      |      | (e.g., /etc/passwd) |
+-----------------+      +------------------------+      +-----------------+
                              |
                              | Reads File Content
                              v
                         Returns to Attacker

Source references

• Paper Title: CMS Firebrand Tec - Local File Inclusion
• Author: R3VAN_BASTARD
• Published: 2010-04-25
• Paper URL: https://www.exploit-db.com/papers/12378
• Raw URL: https://www.exploit-db.com/raw/12378

Original Exploit-DB Content (Verbatim)

======================================================================
         [L.F.I] Firebrand Technologies [L.F.I]
======================================================================
# Exploit Title	: CMS Firebrand Tec Local File Inclusion Vulnerability
# Date		: 04/24/2010
# Author	: R3VAN_BASTARD
# Software Link	: http://www.firebrandtech.com/
# Version	: V.1.x 
======================================================================
Dork		: intext:"Powered by Firebrand Technologies"

Vulneralbility	:
http://localhost/path/index.php?module=../../../../../../../../../../../../../../../etc/passwd%00
======================================================================
Thanks to:
Yoga0400 : Zeth (S3T4N) : Valencia : Mainhack.com (old members)
Serverisdown.org And All.
======================================================================