CVE-2013-1891

Executive Summary

CVE-2013-1891 is a directory traversal vulnerability in OpenCart versions 1.4.7 through 1.5.5.1. The vulnerability exists in the admin/controller/common/filemanager.php script, where the anti-traversal mechanism using str_replace('../', '', $input) is ineffective. An authenticated administrator can bypass this filter using Windows-style backslashes (..\) or nested traversal strings like ..././, allowing access to directories and files outside the intended image/data/ directory. This can lead to unauthorized file reading, directory listing, file creation, deletion, and upload, potentially resulting in full server compromise.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core issue in the OpenCart PHP application. The supply chain risk is low as the vulnerability is in the application itself, not a dependency.

CVSS Breakdown & Threat Level

• CVSS v2 Score: 6.5 (Medium)
• Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Single (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: Partial

Threat Level: Medium. Exploitation requires admin credentials, but once obtained, an attacker can traverse the filesystem, read sensitive files, upload malicious files, and potentially execute code.

Deep Dive & Mechanics

The vulnerability is in admin/controller/common/filemanager.php. The script attempts to prevent directory traversal by removing ../ substrings from user-supplied parameters like directory, name, path, from, and to. The filtering code is:

$directories = glob(rtrim(DIR_IMAGE . 'data/' . str_replace('../', '', $this->request->post['directory']), '/') . '/*', GLOB_ONLYDIR);

This filter has two bypasses:

1. Windows Backslash Bypass: On Windows servers, the path separator is \. The filter only removes ../, so ..\ is not filtered. An attacker can use ..\..\..\ to traverse out of the image/data/ directory.

2. Nested Traversal Bypass: The str_replace function is applied only once. An attacker can use ..././ which, after removing ../, becomes ../. For example, ..././..././..././ becomes ../../../../ after filtering.

The following functions in filemanager.php are affected:

• directory() – list subdirectories
• files() – list image files
• create() – create directories
• delete() – delete files/directories
• move() – rename files/directories
• copy() – copy files/directories
• rename() – rename files/directories
• upload() – upload image/flash files

Vulnerable vs. Patched Code

Vulnerable Code (OpenCart 1.5.5.1):

public function directory() {
    $json = array();
    if (isset($this->request->post['directory'])) {
        $directories = glob(rtrim(DIR_IMAGE . 'data/' . str_replace('../', '', $this->request->post['directory']), '/') . '/*', GLOB_ONLYDIR);
        // ...
    }
}

Patched Code (OpenCart 1.5.6+):

The patched version uses realpath() to resolve the path and then checks if it starts with the allowed base directory. It also filters both ../ and ..\ and uses a recursive removal loop.

public function directory() {
    $json = array();
    if (isset($this->request->post['directory'])) {
        $directory = $this->request->post['directory'];
        // Remove both ../ and ..\ recursively
        while (strpos($directory, '..') !== false) {
            $directory = str_replace(array('../', '..\\'), '', $directory);
        }
        $full_path = realpath(DIR_IMAGE . 'data/' . $directory);
        $base_path = realpath(DIR_IMAGE . 'data/');
        if (strpos($full_path, $base_path) !== 0) {
            // Deny access outside base directory
            $json['error'] = 'Access denied';
        } else {
            $directories = glob(rtrim($full_path, '/') . '/*', GLOB_ONLYDIR);
            // ...
        }
    }
}

Exploitation & Lab Setup

Red Team

Exploit-DB Code: The following exploit code from waraxe-2013-SA#098 demonstrates the vulnerability. It uses a POST request to the directory function with a crafted directory parameter.

<html><body><center>
<form action="http://localhost/oc1551/admin/index.php?route=common/filemanager/directory&token=92aa6ac32b4c8e7a175c3dc9f7754d25" method="post">
<input type="hidden" name="directory" value="..././..././..././..././">
<input type="submit" value="Test">
</form>
</center></body></html>

Usage:

1. Obtain a valid admin session token (e.g., token=92aa6ac32b4c8e7a175c3dc9f7754d25).
2. Replace localhost/oc1551 with the target OpenCart URL.
3. Submit the form. The server will return a JSON list of directories outside the image/data/ folder.

Advanced Exploitation:

• Use the directory function to map the filesystem.
• Use the files function to read arbitrary files (e.g., config.php).
• Use the upload function to upload a PHP shell to a web-accessible directory.
• Use the delete function to delete critical files.

Lab Setup:

• Install OpenCart 1.5.5.1 on a local server (XAMPP, LAMP, etc.).
• Create an admin account and obtain a valid token.
• Use Burp Suite or cURL to send crafted requests.

Blue Team

Detection:

• Monitor for POST requests to admin/index.php?route=common/filemanager/* with unusual directory, name, path, from, or to parameters.
• Look for patterns like ..././, ..\, or multiple ../ sequences.
• Alert on admin actions that create, delete, or upload files outside the image/data/ directory.

Hunting:

• Search web server logs for requests containing ..././ or ..\ in the POST body.
• Check for unexpected files in the web root (e.g., PHP shells).
• Review file modification times for unusual activity.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/index.php?route=common/filemanager/directory with directory=..././..././..././..././
  • POST requests to /admin/index.php?route=common/filemanager/upload with unusual file paths.
• File System:
  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified or deleted configuration files (config.php, admin/config.php).
• Logs:
  • Web server access logs showing directory traversal patterns.
  • OpenCart error logs with file access violations.

Detection Engineering

YARA Rule

rule CVE_2013_1891_OpenCart_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in OpenCart filemanager.php"
        author = "Valters IT"
        date = "2023-10-01"
        reference = "CVE-2013-1891"
    strings:
        $traversal1 = "..././"
        $traversal2 = "..\\"
        $traversal3 = /\.\.\/[^\/]/
    condition:
        any of them
}

Sigma Rule

title: OpenCart Directory Traversal via filemanager.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts in OpenCart admin filemanager
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'route=common/filemanager'
        cs-uri-query|contains: 'token='
        cs-post-body|contains:
            - '..././'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate admin file management
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2013-1891 OpenCart Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"route=common/filemanager"; http_uri; content:"..././"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCart to version 1.5.6 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF (e.g., ModSecurity) to block directory traversal patterns.
3. Restrict admin access to trusted IP addresses only.

Long-Term Fix:

• Implement proper input validation using realpath() and path prefix checks.
• Use a whitelist of allowed characters for file paths.
• Apply the principle of least privilege to the filemanager functionality.

ModSecurity Rule Example:

SecRule REQUEST_URI "@contains route=common/filemanager" "chain,id:1001,deny,msg:'OpenCart Directory Traversal'"
SecRule REQUEST_BODY "@rx ..././|\.\.\\\\" "t:none"

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 10F160FDA870FC8CF3EC387E] */}