Security Advisory - Curesec Research Team1. IntroductionAffected Product: FUDforum 3.0.6Fixed in: not fixedFixed Version Link: n/aVendor Website: http://fudforum.org/forum/Vulnerability Type: XSS, Login CSRFRemote Exploitable: YesReported to vendor: 04/11/2016Disclosed to public: 11/10/2016Release mode: Full DisclosureCVE: n/aCredits Tim Coen of Curesec GmbH2. OverviewFUDforum is forum software written in PHP. In version 3.0.6, it is vulnerableto multiple persistent XSS issues. This allows an attacker to steal cookies,inject JavaScript keyloggers, or bypass CSRF protection. Additionally, FUDforumis vulnerable to Login-CSRF.3. DetailsXSS 1: Via Filename in Private MessageCVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:NDescription: The filename of attached images in private messages is vulnerableto persistent XSS.Proof of Concept:Send a PM to a user. Add an attachment, where the filename is: '"><img src=noonerror=alert(1)>.jpg When the recipient views the PM, the injected code willbe executed.XSS 2: Via Filename in Forum PostsCVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:NDescription: The filename of attached images in forum posts is vulnerable topersistent XSS.Proof of Concept:Create a new forum post. Add an attachment, where the filename is: '"><img src=no onerror=alert(1)>.jpg When viewing the post the injected code will beexecuted.XSS 3: Via Signature in User ProfileCVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:NDescription: When editing a profile, the signature is echoed unencoded, leadingto persistent XSS.Proof of Concept:Visit http://localhost/fudforum/index.php?t=register as signature, use '"></textarea><img src=no onerror=alert(1)> The injected code is either executedwhen the user themselves edits their profile - which may be exploited via loginCSRF - or when an admin visits the edit profile page located here: http://localhost/fudforum/index.php?t=register&mod_id=6&&SQ=1a85a858f326ec6602cb6d78d698f60aLogin CSRFCVSS: Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:NDescription: The login of FUDForum does not have any CSRF protection. Theimpact of this is low, but an attacker might get a victim to disclose sensitiveinformation by using CSRF to log the victim into an attacker-controlledaccount. An example would be the accidental sending of a sensitive privatemessage while being logged into an account controlled by an attacker.Additionally, Login-CSRF may enable an attacker to exploit XSS issues in theuser area.Proof of Concept:<html> <body> <form action="http://localhost/fudforum/index.php?t=login" method="POST"> <input type="hidden" name="login" value="admin" /> <input type="hidden" name="password" value="admin" /> <input type="hidden" name="SQ" value="0" /> <input type="hidden" name="adm" value="" /> <input type="submit" value="Submit request" /> </form> </body> </html>4. SolutionThis issue was not fixed by the vendor.5. Report Timeline04/11/2016 Informed Vendor about Issue (no reply)09/14/2016 Reminded Vendor (no reply)11/10/2016 Disclosed to publicBlog Reference:https://www.curesec.com/blog/article/blog/FUDforum-306-Multiple-Persistent-XSS-amp-Login-CSRF-169.html --blog: https://www.curesec.com/blogtweet: https://twitter.com/curesecCuresec GmbHCuresec Research TeamJosef-Orlopp-Straße 5410365 Berlin, Germanyhttps://www.exploit-db.com/exploits/40802/ |
2016 m. lapkričio 22 d., antradienis
FUDforum 3.0.6 - Cross-Site Scripting / Cross-Site Request Forgery
Užsisakykite:
Rašyti komentarus (Atom)
Komentarų nėra:
Rašyti komentarą