phpbb-exploit

Note: Made this poc hours after the initial disclosure as an exercise, now that they have disclosed it publicly I've put it on public

• Based on the disclosure of Aikido (https://www.aikido.dev/blog/phpbb-authentication-bypass-rce)

Root cause path

• includes/ucp/ucp_login_link.php reads attacker-controlled auth_provider from GET and calls provider_collection->get_provider($request->variable('auth_provider', '')).
• base::login_link_has_necessary_data() returns null in the vulnerable tree, so non-OAuth providers pass the login-link gate.
• apache::login() requires:
  • non-empty submitted form password,
  • PHP_AUTH_USER present,
  • PHP_AUTH_USER === login_username,
  • an existing phpBB row where username equals that value.
• apache::login() does not verify the phpBB password and returns LOGIN_SUCCESS with the target user row.
• ucp_login_link then calls session_create($login_result['user_row']['user_id']).

so what happens is:

ucp.php?mode=login_link -> get_provider($request->variable('auth_provider')='apache') (provider selectable by request) -> 
login_link_has_necessary_data() inherits base -> null (permissive, no gate) -> apache::login() trusts the forged Authorization: Basic -> 
PHP_AUTH_USER and returns LOGIN_SUCCESS without ever checking the DB password -> session_create(victim_id).

Run

Run it with

python3 poc.py http://localhost:8080