Symantec Web Gateway Arbitrary PHP File Upload Remote Code Execution VulnerabilityZDI-15-443: September 16th, 2015
TippingPoint™ IPS Customer ProtectionTippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 19858. For further product information on the TippingPoint IPS:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Symantec Web Gateway. Authentication is required to exploit this vulnerability, however it can be bypassed via reflected cross-site scripting.
The specific flaw exists within the admin_messages.php file which relies on mimetypes and file extensions to block potentially dangerous file uploads. An attacker can exploit this condition to upload arbitrary files as the apache user. Due to loose sudo restrictions, an attacker can add the setuid attribute and execute arbitrary code under the context of root.
Vendor ResponseSymantec has issued an update to correct this vulnerability. More details can be found at:
2015-05-06 - Vulnerability reported to vendor
2015-09-16 - Coordinated public release of advisory
CreditThis vulnerability was discovered by:
Jos Wetzels - LeakFree Security