Security hole compromises web applications

A web services protocol was discovered to contain security vulnerabilities that can permit a hacker to take control of a susceptible server.

  • E-Mail
By  Caroline Denslow Published  July 17, 2005

A web services protocol was discovered to contain security vulnerabilities that can permit a hacker to take control of a susceptible server. According to a GulfTech Research And Development advisory, the flaws found in XML-RPC For PHP and PEAR XML_RPC (or PHPXMLRPC ) affect a large number of Web applications, such as PostNuke, Drupal, b2evolution, and TikiWiki. Unfortunately PHPXMLRPC is vulnerable to a remote php code execution vulnerability that may be exploited by an attacker to compromise a vulnerable system, it said. The vulnerability is caused by the component’s failure to properly sanitise data being passed to an eval() call in the parseRequest() function of the XMLRPC server, GulfTech said. “By creating an XML file that uses single quotes to escape into the eval() call an attacker can easily execute php code on the target server,” it added. XML-based RPC (Remote Procedure Call) systems such as XML-RPC are used with HTTP to power web services, a simple and increasingly popular way of providing services online. PHPXMLRPC implements XML-RPC for the PHP scripting language. A new version of PHPXMLRPC is available that fixes the problem. For some applications using the component, such as eGroupWare and phpGroupWare, independent security firm Secunia recommended restricting access to XML-RPC functionality. The vulnerability in PEAR XML_RPC is related to, but distinct from, the PHPXMLRPC vulnerability, and could also be used to compromise vulnerable servers, according to GulfTech. Version 1.3.1 of the software has been released fixing the problem.

Add a Comment

Your display name This field is mandatory

Your e-mail address This field is mandatory (Your e-mail address won't be published)

Security code