viewFile.php in the scm component of Gforge before 4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file_name parameter.
Gforge versions prior to 4.0 are vulnerable to a critical remote command execution (RCE) vulnerability. Attackers can leverage the viewFile.php script to inject and execute arbitrary commands on the server through the file_name parameter, potentially leading to complete system compromise and data exfiltration.
Step 1: Payload Delivery: The attacker crafts a malicious URL targeting the viewFile.php script. The URL includes a crafted file_name parameter containing shell metacharacters and the desired command to execute (e.g., file_name=;id;).
Step 2: Request Processing: The vulnerable viewFile.php script receives the malicious request.
Step 3: Command Injection: The script, without proper sanitization, passes the attacker-controlled file_name parameter to a shell command (e.g., using system(), exec(), or similar functions).
Step 4: Command Execution: The shell interprets the metacharacters in the file_name parameter and executes the attacker-supplied command (e.g., id).
Step 5: Result Retrieval: The attacker may be able to view the output of the executed command, depending on the script's output handling. This could involve the attacker directly viewing the output in the browser, or the attacker writing the output to a file that the attacker can then retrieve.
The vulnerability stems from insufficient input validation and sanitization within the viewFile.php script of Gforge. Specifically, the script fails to properly sanitize the file_name parameter before passing it to a shell command. This allows an attacker to inject shell metacharacters (e.g., ;, |, &, $ ) into the file_name parameter. When the script attempts to process the file, these metacharacters are interpreted by the shell, leading to the execution of attacker-supplied commands. The root cause is a lack of proper input validation and output encoding, allowing for command injection. There is no buffer overflow or race condition involved; it is a straightforward command injection vulnerability.