Security Bug?

PashaXIII

Hi

Can you please look at here: http://www.miliwoman.com/

Press on links in LATEST UPDATED GALLERIES

I guess someone hack Zen and add this to the albums paths:

栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀愀琀椀漀渀⸀挀漀洀⼀瀀愀最攀愀搀⼀猀栀漀眀开愀搀猀⸀樀猀

And such crappy URLs outputs through this function only:

`<?php printLatestUpdatedAlbums(6,true,false,false,'','',90,90,true) ?>`

http://www.miliwoman.com/栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀愀琀椀漀渀⸀挀漀洀⼀瀀愀最攀愀搀⼀猀栀漀眀开愀搀猀⸀樀猀/Germany/Army

Other paths are fully OK

And I cannot find this in Admin panel, I can remove it through database only

Very strange

acrylian

Very strange indeed. How does the function itself in the album_image_plugin.php file look like? IF that has been altered by someonme you should be able to remove this by overwriting that file with the actual one. Also please read this:
http://www.zenphoto.org/2008/08/troubleshooting-zenphoto/#29

PashaXIII

Thanks for quick respond

I have no such file at all - album_image_plugin.php

And yep I set 660 files/770 directories

acrylian

Sorry, the file is actually named image_album_statistics.php, thought you know/see what I mean, it's within `zp-core/plugins`

I would also suggest you contact your host about that. It may be the case that the hack took place via your accout or the server in general and not via zenphoto. Please also read this recent thread: http://www.zenphoto.org/support/topic.php?id=4656

PashaXIII

Checked `image_album_statistics.php` it fully correct, nothing changed...

It looks like someone added info directly into database

>I would also suggest you contact your host about that

Unfortunately it's not a host, it is dedicated server :-)

PashaXIII

May it be some kind of sql-injection? or something similar?

PashaXIII

Screen from DB:

http://pixhost.ws/avaxhome/b5/2e/000b2eb5.png

And I can delete all this strange info through database only

sbillard

The link you posted above leads to an album which displays, so there must be a folder on your server with that name. This means that someone has hacked your filesystem.

PashaXIII

>This means that someone has hacked your filesystem.

I'm sorry, but no, all folders in `albums` directory does not contain any folders with name:

栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀愀琀椀漀渀⸀挀漀洀⼀瀀愀最攀愀搀⼀猀栀漀眀开愀搀猀⸀樀猀

All directory structure not touched.

Changes take place in DB only.

I hope what it is my mistake and ZenPhoto has no security bugs

olihar

you where not playing around with UTF-16. I got some similar strange things when I did that the other day.

sbillard

Zenphoto is folder/file based. If there is no folder then it cannot find files from the folder and will show nothing. So, somehow that is being treated as a folder by your filesystem.

PashaXIII

>olihar
>you where not playing around with UTF-16. I got some similar strange things when I >did that the other day.

I'm not play with UTF-16 or something similar, character encoding, in Admin panel, set as UTF-8

>sbillard
I have such paths in DB ONLY (zp_albums table):

栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀愀琀椀漀渀⸀挀漀洀⼀瀀愀最攀愀搀⼀猀栀漀眀开愀搀猀⸀樀猀
/Austria/Police

栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀愀琀椀漀渀⸀挀漀洀⼀瀀愀最攀愀搀⼀猀栀漀眀开愀搀猀⸀樀猀/Denmark/Army

There are no such Chinese folders at all. And this paths appear for `printLatestUpdatedAlbums` ONLY. So if this is not a security bug I do not know what it is...

PashaXIII

Unfortunately this shit continue

I was change all possible passwords, check files/directories permission etc.

But it doesn't help

acrylian

Maybe the mysql-account has been hacked then? Is there anything strange in your server logs? I currently don't see that the function `printLatestUpdatedAlbums()` could be the cause as this function just returns what is already in the database. But we of course need to find that out.

PashaXIII

>Maybe the mysql-account has been hacked then?

It is very doubtful. Mysql use only internal IP, especially it look strange after I was change all passwords.

Someone found a way to add data in zp_albums table:

http://pixhost.ws/avaxhome/b5/2e/000b2eb5.png

and `printLatestUpdatedAlbums()` perceive this rows as Latest Updated Albums and display it.

acrylian

Well, we really need to find out the way this data gets into your database. I really doubt it is the printLatestUpdatedAlbums function the leak must be somewhere else.

PashaXIII

>Well, we really need to find out the way this data gets into your database.

Thank you, may be what this can be affected on many installed ZenPhoto

>I really doubt it is the printLatestUpdatedAlbums function the leak must be somewhere else.

Yep, it just Read and Output data.

Attack continue, here is part of dump with new "hack" records:

http://www.miliwoman.com/dump.sql

Too many work for human, I guess it some "hacker script" do this.

Maybe it help.

P.S.
Maybe give `zp_albums` table read only rights? And change it before gallery update

PashaXIII

Yes it's already fixed, but anyway here it is:

http://www.xakep.ru/post/41761/Zenphoto-SQL-Injection-Exploit.txt

Look like someone found a similar vulnerability :-(

PashaXIII

Found another strange regularity, as always as I open similar URL:

http://www.miliwoman.com/栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀愀琀椀漀渀⸀挀漀洀⼀瀀愀最攀愀搀⼀猀栀漀眀开愀搀猀⸀樀猀/Hong.Kong/

In `zp_albums` table appear 2 rows with this paths

PashaXIII

Look like Easter egg ))

if someone will open this link in `zp_albums` table appear 93 row, all my albums.

http://www.miliwoman.com/栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀

Yep, I was right, this is Easter egg

http://www.zenphoto.org/zenphoto/栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀

or

http://www.zenphoto.org/zenphoto/栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀/impressionists/Monet+-+sunrise.jpg.php

Links works pretty fine.

It ever works with ZenPage

http://zenpage.maltem.de/栀琀琀瀀㨀⼀⼀瀀愀最攀愀搀㈀⸀最漀漀最氀攀猀礀渀搀椀挀/Screenshots/Admin-backend/

acrylian

The link you about the bug you posted above is really outdate. But anyway we have indeed a serious Zenphoto security hole here, it is strange that these links even work...

I just checked my database on the Zenpage site and if using this link it really adds to the database. Now we need to find out why it does that. I have opened a top priority ticket for this issue. Thanks for the help so far.

trisweb

Seems like it's just found a string that gets ignored by the PHP album filters, but not by the database. So it's creating records for all these albums even though they do not exist.

It's not SQL-injection per se as nothing malicious is being inserted (this is normal Zenphoto operation, but with a bug that allows more "albums" to be created in the database), but it's still a problem due to the large amounts of data that take up space, etc.

We just need to improve the filtering code to handle cases like this. It may be that it's simply ignoring UTF-16 characters in the PHP string but passing them on to the database. Could be anything, but with these test cases it shouldn't be too hard to filter out.

sbillard

What I do not understand here is how it is getting past the filesystem check. Seems that file-exixts() returns true for this string. BTW, the URL gets rejected by my server and returns a 500 error.

sbillard

We have figured out how to prevent this. Fix is in tonight's nightly build. You will have to clean out the database manually, though.

PashaXIII

Thanks to all