Security hole in attachment downloads for points.

[Bernd]

Personally I tend to copy and paste links from the attachment manager into the text editor to link attachment downloads and i've come across the following issue.

Links in the attachment manager after upload are structured like the example below.

http://yoursite/forum/attachment.php?attachmentid=137&stc=1&d=1137783349
An equivalent link without stc=1 will substract the points or show the purchase attachment template.

If you use the links with STC=1, they will be available for free...anybody who knows this can download anything for free, no matter the amount of points needed.

I believe the issue can be easily fixed, but I'm not a php expert.
If i'm not mistaken the file to be fixed is plugins/vbplaza_attachment_start.php.

I have a shop built around vbplaza and would love to have this fixed since we are about to launch in a few days.

[fly]

Ooops, that's not good.

[Bernd]

nope, it ain't :P

[Ntfu2]

I fail to see how this is a "security" hole?

[fly]

I fail to see how this is a "security" hole?
If we're splitting hairs, would you prefer the term exploit?

[Ntfu2]

Security hole: In computer software, a security vulnerability is a software bug that can be used deliberately to violate security.

Exploit sounds better :D

[fly]

Security hole: In computer software, a security vulnerability is a software bug that can be used deliberately to violate security.

Exploit sounds better :D
Lets discuss why BSD is better than Linux now too! kekekekeke :banana:

[Bernd]

Exploit then...sorry that i didn't use the correct terminology. none the less, it is a hole in the bit of code that checks if an attachment should be paid for :P. Call it exploit, hole, security exploit or security hole for my part. It's one thing for certain...it's annoying as hell...or heaven, depending on your 'religious' preferences.

[Hornstar]

Exploit then...sorry that i didn't use the correct terminology. none the less, it is a hole in the bit of code that checks if an attachment should be paid for :P. Call it exploit, hole, security exploit or security exploit for my part. It's one thing for certain...it's annoying as hell...or heaven, depending on your 'religious' preferences.


amen :banana:

[Quarterbore]

So, has anybody recoded this to use a POST instead of a GET? This is a simple fix from 1st look....

[Bernd]

I am a complete php noob, so no :)
So just replace post with get in vbplaza_attachment_start.php, and the issue could possibly be solved?

[Quarterbore]

Just be careful but yes, the difference between a GET and POST is that teh GET sends the variable name in the url while with a POST the variable and the value is hidden.

Now, I can't promise this will work as there are a great many things about vBulletin that I need to learn but that is certainly the basic PHP code difference between a GET and POST!

[Bernd]

Ok, thanks for explaining. I'll try that one and post the results.


// check if the user has already OK'd the points removal
if ($vbulletin->options['vbbux_attachconfirmpage'] && ($_GET['download'] != '1'))



is the only place in vbplaza_attachment_start.php where "POST" is located. Doesn't seem like that's causing the issue though. To be certain i have replaced it with "GET", but a link with STC=1 will still download without showing the vbplaza download attachment template or substracting the points.

Could there be a plugin hooked into attachment somewhere that contains POST? Still seems to be there's something wrong in the above mentioned php.

[Replicators]

I hope this exploit gets fixed, cause my site relies heavily on the attachment download system.

[fly]

This is odd. Where has CMX been?

[Bernd]

Don't know, haven't seen him answer any questions for about 1.5 weeks.
I've sent him a private message. Personally willing to hire a coder to fix the issue, so If I don't get a reply from cmx within two weeks I'll post the fix here once a coder has accepted the job.

[fly]

Maybe we should all read the 17 stickys in this forum... *hint*hint* LOL

[Quarterbore]

Ok, thanks for explaining. I'll try that one and post the results.


// check if the user has already OK'd the points removal
if ($vbulletin->options['vbbux_attachconfirmpage'] && ($_GET['download'] != '1'))



is the only place in vbplaza_attachment_start.php where "POST" is located. Doesn't seem like that's causing the issue though. To be certain i have replaced it with "GET", but a link with STC=1 will still download without showing the vbplaza download attachment template or substracting the points.

Could there be a plugin hooked into attachment somewhere that contains POST? Still seems to be there's something wrong in the above mentioned php.

I am in the middle of a major progaming effort myself so I can't take the time to debug this but I am confident that the line of code posted above is NOT the code that is the problem ...

I believe you will find the problem somewhere in the pluggin system or one of the hooks and that the code you will be looking for is more like:

<form action=somescript.php method=get ..........>

That code could be just about anywhere however. As I said, I would look in the plugin and hooks, then I would look at the php files for the script...

The developer should be able to advise in seconds where the code is that does this update however...

Good luck and if I find the time I can try to work on it but right now I have a huge project of my own that is taking all my free time and this "Security Gap" does not affect me and my sites at this time...

[Bernd]

Maybe we should all read the 17 stickys in this forum... *hint*hint* LOL

Whoops

"I'm currently involved in a business matter that is 'away from home'."
Says he'll be back around the second to answer posts. Our site is probably going live in about three weeks, so not in that much of a hurry.

@ Quarterbore

Thanks for the extra info..i'll see if i can find some attachment hooks that are relevant in this case.

[Gio~Logist]

if ($vbulletin->options['vbbux_pointsforattachments'] && ($_GET['stc'] != 1))


Naturally, this can be removed my reply removing the && ($_GET['stc'] != 1). However, there has to be a reason as to why that's there. Are you sure that this "exploit" is the same for even regular members? Has anyone tried setting up a test account on their site to see?

[Bernd]

I've already tried removing that line. It doesn't fix the issue.
The exploit can be used by all users, from unregistered to admin.

[CMX_CMGSCCC]

I wouldnt classify this as an exploit, a bug perhaps, in any case, I'll look into it for the next v1.5.7 release.

-CMX