A vulnerability was found in phpBB up to 3.1.1 (Forum Software). It has been declared as critical. Affected by this vulnerability is the function deregister_globals. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect integrity.

The weakness was shared 11/22/2014 by Taoguang Chen as phpBB <= 3.1.1 deregister_globals() Function Bypass as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The vendor was not involved in the public release. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK. Responsible for the vulnerability is the following code:

$input = array_merge(
array_keys($_GET),
array_keys($_POST),
array_keys($_COOKIE),
array_keys($_SERVER),
array_keys($_SESSION),
array_keys($_ENV),
array_keys($_FILES)
);

foreach ($input as $varname)
{
if (isset($not_unset[$varname]))
{
if ($varname !== 'GLOBALS' || isset($_GET['GLOBALS']) ||
isset($_POST['GLOBALS']) || isset($_SERVER['GLOBALS']) ||
isset($_SESSION['GLOBALS']) || isset($_ENV['GLOBALS']) ||
isset($_FILES['GLOBALS']))
{
exit;
}
else
{
$cookie = &$_COOKIE;
while (isset($cookie['GLOBALS']))
{
if (!is_array($cookie['GLOBALS']))
{
break;
}
....
}
}
unset($GLOBALS[$varname]);
}

In the above code we see, when request $_COOKIE['GLOBALS'] = 1, $GLOBALS['GLOBALS'] will be destroyed by unset(). This means $GLOBALS array will be destroyed. This also means you will not be able to use $GLOBALS['key'] to access or control a global variable in all scopes throughout a script. Because the binding between the $GLOBALS array and the global symbol table has been broken. All global variables registered by PHP form $_COOKIE, $_SERVER, $_SESSION, $_ENV, and $_FILES arrays will be not unregistered.

A public exploit has been developed by Taoguang Chen in PHP and been published immediately after the advisory. It is possible to download the exploit at packetstormsecurity.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The code used by the exploit is:

$_COOKIE['GLOBALS'] = 1;
$_COOKIE['ryat'] = $ryat = 'ryat';

deregister_globals();

var_dump($GLOBALS);
var_dump($ryat);

$GLOBALS['ryat'] = 'hi';

var_dump($GLOBALS);
var_dump($ryat);

The mailinglist post contains the following remark:

I had reported the issue to the phpBB developers, but they do not consider this a security issue.

The vulnerability is also documented in the vulnerability database at X-Force (99026).

Productinfo

Type

• Forum Software

Name

• phpBB

Version

• 3.1.0
• 3.1.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion