Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: InfoSec Handlers Diary Blog - Scans for FCKEditor File Manager InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Scans for FCKEditor File Manager

Published: 2014-03-17
Last Updated: 2014-03-18 01:01:39 UTC
by Johannes Ullrich (Version: 1)
2 comment(s)

FCKEditor (now known as CKEditor [1]) is a popular full featured GUI editor many web sites use. For example, you frequently find it with blog systems like WordPress or as part of commenting/forum systems. As an additional feature, a filemanager can be added to allow users to upload images or other files. Sadly, while a very nice and functional plugin, this features if frequently not well secured and can be used to upload malicious files. We have seen some scans probing specifically for this file manager plugin:

HEAD /js/fckeditor/editor/filemanager/connectors/test.html 
HEAD /admin/FCKeditor/editor/filemanager/connectors/test.html 
HEAD /admin/FCKeditor/editor/fckeditor.html
HEAD /include/fckeditor/_samples/default.html 
HEAD /include/fckeditor/editor/filemanager/connectors/test.html
 
These requests did not set a user agent or a referrer. The following set did however use "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1;" and instead of a HEAD request it used a GET request, indicating that there are different distinct tools looking for the same vulnerability:
 
GET /editor/editor/filemanager/connectors/uploadtest.html HTTP/1.1
GET /editor/editor/filemanager/upload/test.html HTTP/1.1
GET /editor/editor/filemanager/browser/default/connectors/test.html HTTP/1.1
GET /editor/editor/filemanager/connectors/test.html HTTP/1.1
GET /admin/fckeditor/editor/filemanager/connectors/test.html HTTP/1.1
GET /FCKeditor/editor/filemanager/upload/test.html HTTP/1.1
GET /Fckeditor/editor/filemanager/browser/default/connectors/test.html HTTP/1.1
GET /admin/FCKeditor/editor/filemanager/connectors/uploadtest.html HTTP/1.1
GET /admin/FCKeditor/editor/filemanager/upload/test.html HTTP/1.1
GET /Fckeditor/editor/filemanager/connectors/test.html HTTP/1.1
GET /admin/fckeditor/editor/filemanager/browser/default/connectors/test.html HTTP/1.1
GET /FCKeditor/editor/filemanager/connectors/uploadtest.html HTTP/1.1

I am still looking for any samples of files these script attempt to upload. If you got any, please let use know.

[1] http://ckeditor.com

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

2 comment(s)
Diary Archives