JVN#95589314: Joruri Gw vulnerable to arbitrary file upload

Overview

Joruri Gw provided by SiteBridge Inc. contains a vulnerability that may allow an attacker to upload arbitrary files.

Products Affected

Joruri Gw Ver 3.2.0 and earlier

Description

Joruri Gw provided by SiteBridge Inc. is groupware which runs on Ruby on Rails. Joruri Gw contains a vulnerability that may allow an attacker to upload arbitrary files (CWE-434).

Impact

A user may upload arbitrary files.
When PHP code execution is enabled on the server, a user may execute arbitrary PHP code by uploading PHP files.

Solution

Disable Unnecessary Functions from the System
Disable PHP code execution on the server if it is not necessary.
Configure the server with only the necessary functions.

Change Server Settings
If PHP code execution features are required, configure the server to prevent uploaded PHP files being executed.
installation manual of Joruri Gw Ver.2.3.1 and later contains the following (example configuration for Apache httpd);

#Insert the following when PHP execution feature is enabled on the server.
<Directory "/var/share/jorurigw/public">
php_admin_flag engine off
</Directory>

Vendor Status

Vendor	Status	Last Update	Vendor Notes
SiteBridge Inc.	Vulnerable	2018/04/26

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

CVSS v3 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Base Score: 3.5

Attack Vector(AV)	Physical (P)	Local (L)	Adjacent (A)	Network (N)
Attack Complexity(AC)	High (H)	Low (L)
Privileges Required(PR)	High (H)	Low (L)	None (N)
User Interaction(UI)	Required (R)	None (N)
Scope(S)	Unchanged (U)	Changed (C)
Confidentiality Impact(C)	None (N)	Low (L)	High (H)
Integrity Impact(I)	None (N)	Low (L)	High (H)
Availability Impact(A)	None (N)	Low (L)	High (H)

CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N