PHP Code Injection in FOSSBilling Configuration

Executive Summary

This vulnerability exists in FOSSBilling versions 0.6.10 through 0.7.2 in the `Config::prettyPrintArrayToPHP()` method. When configuration values are updated, string values are written into the `config.php` file without escaping single quotes.

Because `config.php` is included on every HTTP request, an attacker with admin privileges can inject arbitrary PHP code into this file. This injected code will then execute on every subsequent request, allowing the attacker to run malicious PHP code on the server.

Version 0.8.0 of FOSSBilling contains a patch to fix this issue. Workarounds include restricting admin access to trusted personnel, auditing the `config.php` file for unexpected PHP code, and restricting access to admin API endpoints that modify configuration at the reverse proxy or WAF level.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with admin privileges to inject and execute arbitrary PHP code on the server hosting FOSSBilling.

The impact includes potential full compromise of the server, unauthorized access to sensitive data, disruption of billing and client management services, and the ability to perform further attacks within the environment.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by auditing the config.php file for unexpected or malicious PHP code injections, especially looking for unescaped single quotes in configuration values.

Since the vulnerability involves PHP code injection via the config.php file, you can check the contents of this file for suspicious code.

• Use commands like `grep -n "<?php" config.php` to find any PHP opening tags that should not be present.
• Use `grep -E "['\"]" config.php` to look for unescaped single quotes or suspicious string patterns.
• Monitor HTTP requests to the admin API endpoints that modify configuration for unusual activity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting admin access to trusted personnel only to prevent unauthorized configuration changes.

Audit the config.php file for unexpected PHP code and remove any malicious injections.

At the reverse proxy or Web Application Firewall (WAF) level, restrict access to admin API endpoints that modify configuration to trusted IPs or users.

Upgrade FOSSBilling to version 0.8.0 or later, which contains a patch for this vulnerability.

Useful 0 Not Useful 0