Security researchers have identified an arbitrary file upload vulnerability (CVE-2022-40932) in the Zoo Management System v1., a popular software used by zoos and animal parks for managing operations. The vulnerability is located in the "Gallery" module of the background management system, specifically in the "gallery" file's picture upload point. Malicious actors can exploit this issue to upload arbitrary files, leading to possible execution of unauthorized code and compromising the security of the affected system.

Vulnerability Details

In the "Gallery" module of the Zoo Management System v1. background management application, users are allowed to upload pictures in the gallery section. However, the system fails to properly validate file extensions during the upload process, which leaves it open to abuse by malicious actors. Exploiting this vulnerability, attackers can upload potentially harmful files, such as PHP scripts or executable files, which could lead to remote code execution, data breaches, and unauthorized system access.

Here's a code snippet that demonstrates the arbitrary file upload vulnerability

// Code in "gallery" file of the "Gallery" module
$uploadedImage = $_FILES['image'];
$uploadPath = "uploads/gallery/";
$allowedExtensions = array("jpg", "jpeg", "png");

$extension = strtolower(pathinfo($uploadedImage['name'], PATHINFO_EXTENSION));

if (in_array($extension, $allowedExtensions)) {
    move_uploaded_file($uploadedImage['tmp_name'], $uploadPath . $uploadedImage['name']);
    // Proceed with further image processing
} else {
    echo "Invalid file type";
}

The code above is expected to only allow uploading images with the permitted extensions (JPG, JPEG, and PNG). However, due to the lack of proper validation, an attacker could bypass this restriction and upload a file with any extension. For example, an attacker could upload a PHP script and execute it remotely by accessing the file from the attacker's web browser, leading to compromised system security.

Exploit

The exploit could be carried out in several ways, including using HTTP requests with file uploads or using tools specifically designed for exploiting file upload vulnerabilities (such as Burp Suite). The exploit might involve sending a specially crafted HTTP POST request to the upload endpoint with a chosen file containing malicious code.

Proof of Concept (PoC)

Below is a sample cURL command that demonstrates the exploit.

curl -X POST -F "image=@evil.php" "https://TARGET_WEBSITE/zoo_management/gallery_upload_endpoint.php";

In this example, evil.php is a file containing malicious PHP code, and TARGET_WEBSITE is the web address of a vulnerable Zoo Management System instance.

Mitigation

The developers of Zoo Management System have been notified about this issue and are expected to release a patch soon. In the meantime, administrators of the affected systems should implement the following mitigation measures:

References

Original Advisory Link: [Link to the original advisory, if available]
CVE Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40932
Zoo Management System Website: [Link to the Zoo Management System website, if available]

Conclusion

In summary, CVE-2022-40932 is a critical arbitrary file upload vulnerability in the Zoo Management System v1. that could lead to remote code execution and unauthorized access. Users and administrators of the affected systems are advised to implement the suggested mitigation measures and update their installations as soon as a patch is released to prevent potential exploits.

Timeline

Published on: 09/22/2022 16:15:00 UTC
Last modified on: 09/23/2022 19:08:00 UTC