Exploit-DB #25441
Description: Invision Power Board 1.x?/2.x/3.x - Admin Takeover
Type: webapps
Platform: php
Date: 2013-05-14
Author: John JEAN

Exploit:
IPB (Invision Power Board) all versions (1.x? / 2.x / 3.x) Admin account Takeover leading to code execution

Written on : 2013/05/02
Released on : 2013/05/13
Author: John JEAN (@johnjean on twitter)
Affected application: Invision Power Board <= 3.4.4
Type of vulnerability: Logical Vulnerability / Bad Sanitization
Required informations : Administrator's email
Evaluated Risk : Critical
Solution Status : A patch has been released which fixes these vulnerabilities
References :  http://www.john-jean.com/blog/securite-informatique/ipb-invision-power-board-all-versions-1-x-2-x-3-x-admin-account-takeover-leading-to-code-execution-742


[0] Application description & Deployment estimation

From wikipedia.org:
Invision Power Board (abbreviated IPB, IP.Board or IP Board) is an Internet forum software produced by Invision Power Services, Inc. It is written in PHP and primarily uses MySQL as a database management system, although support for other database engines is available. While Invision Power Board is a commercially sold product, there is a large modding community and many of these modifications are free. In addition, many groups offer the download or design of free and paid skins.

----

This software is deployed on very popular websites such as: NASA, EMI, NHL, NBC, O'Reilly, Evernote, ...

You can easily find tens of thousands of deployed instances using Google dorks such as: "inurl:index.php?app=core" or "powered by Invision Power Board".



[I] Logic Flaw

	A) Overview

IPB harbors a sanitization flaw in its registration form and user control panel (accessible once logged in). Incorrect e-mail address validation code allows an attacker to take over the admin account without prompting any alert but preventing the real admin to login afterwards. After a successful takeover, the attacker can plant a PHP backdoor using IPB's templating system. Thorough administrators will inspect total file system after they recover their hacked account, while other administrators might assume they are dealing with a bug, receive their new password using "Password recovery" system and leave the backdoor intact. Attacker may also use the "Retrieve password" process to mislead the admin into thinking their account was locked due to unsuccessful login attempts and not investigating further, thus preserving the backdoor.


	B) Required data

		1) Administrator's login name

The admin login is easily found by clicking on "The moderating Team" link on recent IPB's footer, or using the URL below: index.php?app=forums&module=extras§ion=stats&do=leaders


		2) Administrator's e-mail

Obtaining the admin e-mail may be more complicated as there is no automated way to get it. The attacker can get it through:

     - using whois on domain.tld to get registrar informations
     - looking up a prospective e-mail on Facebook and see if a matching profile shows up
     - using Gravatar (Gravatar is a personal avatar you can find on most blogs, forum, etc comments based on user e-mail address). Attacker can create a script to retrieve an email based on an avatar. For example mine is: http://www.john-jean.com/gravapwnd.php?zboob=john@wargan.com
     - do sourcing using FB, G+, Twitter, Google SERP, ...
     - use SE methods, such as faked e-mail catcher; or use XSSs on known websites consulted by the target.


	C) Explanation

This vulnerability is grounded on both a mistake in MySQL knowledge and bad sanitization of the $email variable.
		1) First of all, let's summarize how MySQL works:

			- Truncating while INSERT

During an INSERT query, if the string exceeds the field size defined when creating the table, the string will be truncated. E.g.:

************************ BEGIN OF CODE ************************
CREATE TABLE `test` (
`limitvarchar` varchar(5) NOT NULL
);
---
INSERT INTO `test` (`limitvarchar`) VALUES ('123456789');
---
SELECT * FROM `test`
> 12345
************************* END OF CODE ***************************

However, the string is not truncated during SELECT queries. The following query will not return any result:

************************ BEGIN OF CODE ************************
SELECT * FROM `test` WHERE `limitvarchar` = "123456"
************************* END OF CODE ***************************

MySQL use permissive SELECT: 
SELECT ignores spaces at the end of strings. Let's INSERT some datas:

************************ BEGIN OF CODE ************************
INSERT INTO `divers`.`test` (`limitvarchar`) VALUES ('1    ');
INSERT INTO `divers`.`test` (`limitvarchar`) VALUES ('1   ');
INSERT INTO `divers`.`test` (`limitvarchar`) VALUES ('1  ');
INSERT INTO `divers`.`test` (`limitvarchar`) VALUES ('1 ');
INSERT INTO `divers`.`test` (`limitvarchar`) VALUES ('1');
************************* END OF CODE ***************************

Thus the following query will yield the 5 records inserted before:

************************ BEGIN OF CODE ************************
SELECT * FROM `test` WHERE limitvarchar='1    '
************************* END OF CODE ***************************

Now, let's have a look at the checkEmailAddress function of admin/source/base/core.php:

************************ BEGIN OF CODE ************************

/**
	 * Check email address to see if it seems valid
	 *
	 * @param	string		Email address
	 * @return	boolean
	 * @since	2.0
	 */
	static public function checkEmailAddress( $email = "" )
	{
		$email = trim($email);

		$email = str_replace( " ", "", $email );

		//-----------------------------------------
		// Check for more than 1 @ symbol
		//-----------------------------------------

		if ( substr_count( $email, '@' ) > 1 )
		{
			return FALSE;
		}

 	if ( preg_match( '#[\;\#\n\r\*\'\"<>&\%\!\(\)\{\}\[\]\?\\/\s\,]#', $email ) )
		{
			return FALSE;
		}
		/* tld increased to 32 characters as per RFC - http://community.invisionpower.com/resources/bugs.html/_/ip-board/ipstextche