CSRF, Authentication Bypass & RCE in GuppY

High-Tech Bridge Security Research Lab discovered two vulnerabilities in open web portal software GuppY. A remote attacker can delete arbitrary files, bypass authentication and execute arbitrary file on vulnerable system.

1) Cross-Site Request Forgery in GuppY

The vulnerability exists due to insufficient validation of HTTP request origin, when deleting local files. A remote unauthenticated attacker can create a specially crafted malicious web page with CSRF exploit, trick a logged-in administrator to visit the page, spoof the HTTP request, as if it was coming from the legitimate user, and delete arbitrary file on the system.

A simple exploit below will delete file "/admin/mdp.php", which contains administrator's password. To reproduce the vulnerability, log in to the website with administrative credentials, copy-paste the code below into an empty HTML file and open it in your browser:
<form action="http://[host]/admin/admin.php?lng=en&pg=upload" method="POST">
<input type="hidden" name="rep" value="file" />
<input type="hidden" name="del" value="../admin/mdp.php" />
<input type="submit" value="Submit request" />
</form>


2) Improper Authentication in GuppY

The vulnerability exists due to incorrectly implemented authentication mechanisms, when "/admin/mdp.php" file is absent on the system. A remote attacker can bypass authentication by setting "GuppYAdmin" cookie parameter to value "-2111096325||" and upload arbitrary PHP file using the "/admin/editors/upload/upload.php" script.

Successful exploitation of this vulnerability requires, that "/admin/mdp.php" is deleted from the system (see vulnerability #1).

Below is a dump of HTTP GET request, that can be used to bypass authentication process and get access to upload form:
GET /admin/editors/upload/upload.php?namerepconfig=1 HTTP/1.1
Host: [host]
Accept-Language: en-US
Accept-Encoding: gzip, deflate
Cookie: GuppYAdmin=-2111096325||;
Connection: close

Once the attacker has access to upload form, it is possible to upload and execute arbitrary PHP file on the system with privileges of the web server.