Magnolia CMS versions 4.5.8 and below suffer from multiple access control vulnerabilities that allow a non-administrative user to access and execute administrative functionalities.
fb6c27a0797c4b1ac97ad5992f8eddfb9cd896a72f7e7d7b719810e87f85d694
Subject:
======
Multiple access control vulnerabilities in Magnolia CMS, Community and
Enterprise editions
CVE ID:
=======
CVE-2013-4621
Summary:
========
A non-admin user (such as default users eric / peter) can access and
execute multiple administrative functionalities of the CMS by accessing
directly the specific URLs.
Product:
========
Magnolia CMS
Vendor:
=======
Magnolia International Ltd.
Affected versions:
==================
Magnolia CMS <= 4.5.8
Tested on: 4.5.8, 4.5.7 and 4.5.3, both Community and Enterprise editions
Not-affected version:
=====================
Magnolia CMS 4.5.9
Product information:
====================
Magnolia CMS is an open-source Web Content Management System that focuses
on providing an intuitive user experience in an enterprise-scale system.
Vulnerability details:
======================
The following functionalities can be accessed and executed by a non-admin
user based on the URL:
- View and set the log level of Magnolia
http://127.0.0.1:8080/magnoliaPublic/.magnolia/log4j
- Read Magnolia log files (can contain sensitive information)
http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/logViewer.html?command=displayFileContent&fileName=magnolia-error.log
http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/logViewer.html?command=displayFileContent&fileName=magnolia-debug.log
- View Magnolia configuration:
http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/configuration.html
- View permissions of Magnolia users. Also can be used for user enumeration
http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/permission.html
- Send arbitrary email messages
http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/sendMail.html
- View the list of installed modules
http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/installedModulesList.html
- Execute arbitrary queries in the repository (limited by the current
user's rights)
http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/jcrUtils.html
Vendor contact log:
===================
2013-04-25: Contacting vendor through support@magnolia-cms.com
2013-04-29: Vendor acknowledges the receipt of the advisory
2013-04-29: Vendor confirms the vulnerability
2013-06-03: Vendor releases version 4.5.9 which fixes the vulnerability
Credits:
========
This vulnerability was discovered by Adrian Furtuna
http://pentest-tools.com
Solution:
=========
Upgrade to the latest version of Magnolia CMS