epoch's add-passwd.cgi script

[salsbury]

has anyone looked over this script for security errors? i'm looking over it now and wow. i mean, i e-mailed them about the problems probably over a year ago, and they're still not fixed apparently. but wow.

can you say "wide open"? there's not even a password check.

if you're using this script, for a good time, if you have LWP, run this from your shell, or any shell:

POST http://www.yourdomain.com/cgi-bin/add-passwd.cgi

and enter:

ADD+/full/path/to/.htpasswd+foo+bar

followed by ^D.

if you don't have this script on your own site but you know it is on someone else's site, please ignore the above.

note you can specify the filename in question - that is, you can specify index.html, if you so choose. i already know of one person who has been severly impacted by this. how many more have there been?

btw. they suggest to fix it, uncomment some lines at the top. that doesn't actually fix it, it just hides it, and lets anyone whose IP ends with their class C octets to still hack with impunity.

moderators, if you feel like editing my post, fine, but make sure that Epoch sees it first. thx.

[salsbury]

wish i could change the subject, sorry.

to clear this up guys, what this means is that ANYONE, ANYWHERE can:

1) add any users to your site that they want to. hundreds, thousands, whatever.
2) modify any of your files. this means that they can replace your index page, your affiliate codes all over your site, anything they want to.

i've seen this happen and i've verified it does work. your sites are at risk. i'd love for Epoch to see this and fix the problem.

[notjoe]

Originally posted by salsbury
wish i could change the subject, sorry.

to clear this up guys, what this means is that ANYONE, ANYWHERE can:

1) add any users to your site that they want to. hundreds, thousands, whatever.
2) modify any of your files. this means that they can replace your index page, your affiliate codes all over your site, anything they want to.

i've seen this happen and i've verified it does work. your sites are at risk. i'd love for Epoch to see this and fix the problem.

This would not be hard to fix at all, simply find out the IP of the machine(s) which add users to your site and hack up some code to do IP checking so that if the IP != anything which is allowed you deny the request.

Just my 2 cents.

[salsbury]

Originally posted by notjoe



This would not be hard to fix at all, simply find out the IP of the machine(s) which add users to your site and hack up some code to do IP checking so that if the IP != anything which is allowed you deny the request.

Just my 2 cents.

that's a possible "hack" but not really a fix. then, if someone hacks that IP, they will have ready access to any of your files. i don't think Epoch is malicious, but if they wanted to be, they could destroy your entire site through this script.

a better solution, imo, would be to have a encrypted password stored in your copy of the script, and then their servers have to include that password in any modifications.

[Petr]

You are not the only one who informed Epoch about this, Salsbury... In the updated version of the script they check if the script is called from certain Epoch's IPs...

Also, you might be surprised how many other processing companies have the same security hole in their scripts.

[notjoe]

Originally posted by salsbury


that's a possible "hack" but not really a fix. then, if someone hacks that IP, they will have ready access to any of your files. i don't think Epoch is malicious, but if they wanted to be, they could destroy your entire site through this script.

a better solution, imo, would be to have a encrypted password stored in your copy of the script, and then their servers have to include that password in any modifications.

I think if someone hacks that IP, which chances being that IP is the transaction server then epoch has A LOT more serious shit to worry about than some websites!

[salsbury]

Originally posted by Petr
You are not the only one who informed Epoch about this, Salsbury... In the updated version of the script they check if the script is called from certain Epoch's IPs...

Also, you might be surprised how many other processing companies have the same security hole in their scripts.

the script still appears to be distributed with those lines commented out. in any case, if they are these:

# Check for post from Epoch's Class C
# (uncomment the following three lines to activate this check)
# if ($ENV{'REMOTE_ADDR'} !~ /208.236.105/) {
# exit(-1);
# }

then that's not even remotely sufficient.

[Petr]

Salsbury, I know. But IMO this issue shouldn't be discussed on a public forum.

[salsbury]

Originally posted by Petr
Salsbury, I know. But IMO this issue shouldn't be discussed on a public forum.

it's been going on for over a year. that's more than enough time between notification and release of exploit. but like i said, if mods want to edit it, fine, just make sure Epoch sees it and fixes it.

heh heh, the ad on the screen while i'm posting it is for epoch. that's funny.

[Kick Ass]

Originally posted by Petr
Salsbury, I know. But IMO this issue shouldn't be discussed on a public forum.

why not here ?

[salsbury]

bizarre!

i just had a look at the Jettis add-passwd.cgi script and it's almost exactly the same as the insecure Epoch one. the only difference is that it allows access from thousands of IP addresses instead of just hundreds:

# Jettis IP addresses
my $IPSUBNET1 = '12.129.161';
my $IPSUBNET2 = '207.136.171';

################################################## ############################
# Check remote address to verify the sender
################################################## ############################
if(!$ENV{REMOTE_ADDR} or (
($ENV{REMOTE_ADDR} !~ /$IPSUBNET1/) and
($ENV{REMOTE_ADDR} !~ /$IPSUBNET2/) ) ) {
print "Unauthorized access.\n";
exit 1;
}

for those of you not familiar with regular expressions...

/12.129.161/ will match any ip address with 12anything129anything161. so 192.12.129.161 will match it, 24.212.129.161 will match it, 12.129.161.0-255 will match it. obviously, very dangerous.

are Jettis and Epoch the same people or did one copy the script from the other?

[DrewKole]

Originally posted by Kick Ass



why not here ?

Because of the fact any wannabe newb now knows how to hack into paysites runnin epoch's script? =)

It's beyond stupid to post all of that info here...

BEYOND...

[salsbury]

Originally posted by DrewKole
Because of the fact any wannabe newb now knows how to hack into paysites runnin epoch's script? =)

It's beyond stupid to post all of that info here...

BEYOND...

it's beyond stupid that Epoch (and now Jettis apparently) distribute scripts that severely impact their customer's site security, i agree.

Epoch's known about it for well over a year, that's a fact. Jettis, afaict, has copied Epoch's script so Jettis kinda gets what they deserve eh?

like i said in my original post, mods can edit it, of course, and i won't complain. i just want it known that the scripts are severely insecure.

[buran]

That Epoch script has been around since 1997!

Yeah, I won't run any of the stock billers passwd management scripts. Security is one reason, the other is they're not designed to work when you store your usernames in mysql.

Although, check out PSW's scripts, they encrypt everything, and they provide you a key file, so that shit is pretty secure.

I've rewritten Epoch, CCBill, iBill, and now PSW. I also have a thing against Perl code...

[Rand]

To answer the post on Epoch's script being insecure:

1) That is an old script. A new one has been available for quite some time.
2) For the old script - it still requires knowledge of file paths even if you had the ip check commented out. Yes I know - it's "security through obscurity" but it does offer an additional level of protection.
3) If you did have the ip check enabled - please tell me how you would subvert that without subverting our systems here. If that happens then I am 100% sure they won't be doing it to add user/passwords to sites external to our systems. We get several break-in attempts a second here. Security is not a stranger to us.
4) If you were able to subvert all the above, the new script will not allow hidden commands in the data fields.

Joel Hall CTO Paycom/Epoch

[Sleepy]

I just had Epoch installed on my server and it can only be posted too by one I.P. number. I guess thats the 'latest greatest' version.

[salsbury]

Originally posted by Rand
[B]To answer the post on Epoch's script being insecure:

1) That is an old script. A new one has been available for quite some time.

i don't see much difference (i have a copy which i'm told is new). i remember this same script allowed people to execute programs from remote as well. so you can not only add users and passwords but you can do things like launch inetd - for those of you who don't know, if you can launch inetd, you can basically create a passwordless shell into your host.

2) For the old script - it still requires knowledge of file paths even if you had the ip check commented out. Yes I know - it's "security through obscurity" but it does offer an additional level of protection.

only to add users to the passwd file. but with the script, you can get shell access or do anything you want, so you can easily find the password file. trivial.

3) If you did have the ip check enabled - please tell me how you would subvert that without subverting our systems here. If that happens then I am 100% sure they won't be doing it to add user/passwords to sites external to our systems. We get several break-in attempts a second here. Security is not a stranger to us.

perhaps not a stranger, maybe an acquaintance? i dunno, i don't see it at all. i could list out all the problems i see, but i'll just discuss the ip check now:

# Check for post from Epoch's Class C
#(uncomment the following three lines to activate this check)
if ($ENV{'REMOTE_ADDR'} !~ /208.236.105/) {
exit(-1);
}

i don't want to go in to the whole regular expressions thing - check man perlre or man regex for that - but let's just say that allows 511 IP addresses. not just 255. 24.208.236.105 can access it as well, for instance - that's someone's random cable modem. ping it, check it out, it's online. if they ran a proxy, bam, you have access to all of Epoch's customers through this new "secure" script.

i wonder what your plans are should you ever have to switch hosts, btw?

4) If you were able to subvert all the above, the new script will not allow hidden commands in the data fields.

the "new" script i see does still allow you to execute commands.

i just don't see any form of security in this script at all. perhaps you have a newer one that your customers don't know about yet, i'm not sure, but i've never seen a add-passwd.cgi script different than the one i'm looking at now.

[Rand]

salsbury,

Please send me the script you are using. Send it to [email protected].

---Rand

[salsbury]

Originally posted by Rand
salsbury,

Please send me the script you are using. Send it to [email protected].

---Rand

here

[r-c-e]

Originally posted by DrewKole


Because of the fact any wannabe newb now knows how to hack into paysites runnin epoch's script? =)

It's beyond stupid to post all of that info here...

BEYOND...

Well from what I've read, this isn't exactly 0-day cracking here. Its been out and about for over a year. Its public and as such should be able to be discussed in a public forum. Where would a better place be? On a vulnerability list/forum? You dont think crackers read there?

I think the point is this: This is something Epoch should be addressing, and people should not have to cover up for Epoch's mistakes, simply because there may be people on this board using them. If anything this will bring it to people's attention who have not yet heard about the exploit or dont have the skills to discover the vulnerability themselves.

[salsbury]

Originally posted by r-c-e


Well from what I've read, this isn't exactly 0-day cracking here. Its been out and about for over a year. Its public and as such should be able to be discussed in a public forum. Where would a better place be? On a vulnerability list/forum? You dont think crackers read there?

I think the point is this: This is something Epoch should be addressing, and people should not have to cover up for Epoch's mistakes, simply because there may be people on this board using them. If anything this will bring it to people's attention who have not yet heard about the exploit or dont have the skills to discover the vulnerability themselves.

i'm hoping that epoch will contact their clients and distribute a more secure solution (one which uses a hash in the CGI instead of IP based authentication, for instance).

[Rand]

Salsbury,

The script you posted is the older script. If you would like to comment on the current script we would welcome any thoughts you have about it.

Regarding the older script, "If" you have the IP check commented out then there is a possibility that someone might be able to add user/pass data to your member file. However, the IP address check function should NOT be commented out. You should remember that the add/pass script is a template that you may modify at your discretion.

Any Epoch client who wants to get the newer script can request it by writing to [email protected]. We can send you the script to allow you to insert it yourself, or you can have our tech support department install the script for you. Your choice.

We are always open to input from webmasters regarding all aspects of our operations. Constructive comments benefit all.

--Rand

[salsbury]

guess i haven't seen the "new" script then. i've only seen one that i was told was "new". ok.

please note everyone that uncommenting the IP check lines is not sufficient to protect your sites from total remote access. ask them for a new script as advised.

[Thee Johnclave]

salsbury... was just notified of this thread. We've been distributing a completely different script for quite some time and will also be mailing all Jettis clients to ensure no one is using this outdated script. Any GFYer's who do not receive an email can feel free to contact me directly.

[email protected]

[salsbury]

excellent Jettis. hopefully Epoch will also contact all of their clients and then the matter can basically be considered "closed".