exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

TYPO3 Extension ke_questionnaire 2.5.2 Information Disclosure

TYPO3 Extension ke_questionnaire 2.5.2 Information Disclosure
Posted Dec 1, 2014
Site redteam-pentesting.de

The TYPO3 extension ke_questionnaire stores answered questionnaires in a publicly reachable directory on the webserver with filenames that are easily guessable. Version 2.5.2 is affected.

tags | exploit
advisories | CVE-2014-8874
SHA-256 | 3e3bbfd6986ae9575ca39092c83c53d3007704cdcaacf2ddb4e6429a02d9a751

TYPO3 Extension ke_questionnaire 2.5.2 Information Disclosure

Change Mirror Download
Advisory: Information Disclosure in TYPO3 Extension ke_questionnaire

The TYPO3 extension ke_questionnaire stores answered questionnaires in a
publicly reachable directory on the webserver with filenames that are
easily guessable.


Details
=======

Product: ke_questionnaire
Affected Versions: 2.5.2 (possibly all versions)
Fixed Versions: unknown
Vulnerability Type: Information Disclosure
Security Risk: medium
Vendor URL: http://kequestionnaire.kennziffer.com/
Vendor Status: notified
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2014-009
Advisory Status: published
CVE: CVE-2014-8874
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8874


Introduction
============

"The TYPO3 extension kequestionnaire allows to easily and quickly create
and evaluate individual questionnaires online in any TYPO3 website."

(translated from the official website of ke_questionnaire)


More Details
============

Files containing the answered questionnaires are stored in the
"typo3temp" directory within the TYPO3 installation. As the source code
of the ke_questionnaire extension shows, the filename of an answered
questionnaire is solely based on the questionnaire ID and the user ID of
the user who created the questionnaire.

Source code (shortened):
------------------------------------------------------------------------------
function init() {
global $BE_USER,$LANG,$BACK_PATH,$TCA_DESCR,$TCA,$CLIENT,$TYPO3_CONF_VARS;

$this->temp_file = \
'tx_kequestionnaire_temp_'.$this->q_id.'_'.$GLOBALS['BE_USER']->user['uid'];
[...]
}
[...]
function createSchedulerTask(){
$myVars = $GLOBALS['BE_USER']->getSessionData('tx_kequestionnaire');
$file_path = PATH_site.'typo3temp/'.$this->temp_file;
[...]
}
------------------------------------------------------------------------------

A valid URL that returns the answers to a questionnaire could look like
the following:

http://www.example.com/typo3temp/tx_kequestionnaire_temp_15999_7



Proof of Concept
================

Using the tool wfuzz[1] it is possible to search for answers to
questionnaires on a TYPO3 site that employs ke_questionnaire:

------------------------------------------------------------------------
$ python wfuzz.py -c -z range,14000-15000 -z range,1-10 --hc 301 \
http://example.com/typo3temp/tx_kequestionnaire_temp_FUZZ_FUZ2Z
------------------------------------------------------------------------


Workaround
==========

The webserver config should deny access to answered questionnaire files,
for example by adding an .htaccess file that limits access to
tx_kequestionnaire_* files (this may hinder online evaluation of the
questionnaires).


Fix
===

No official fix available.


Security Risk
=============

Depending on the questions in the questionnaire the answered
questionnaires may contain personal information including participants'
full names, addresses and so on. The risk therefore strongly depends on
the information supplied in the questionnaires. Since this information
will at least often contain email addresses, it is rated as at least a
medium risk.


Timeline
========

2014-04-21 Vulnerability identified
2014-04-30 Customer approved disclosure to vendor
2014-05-13 Vendor notified
2014-05-20 Vendor works with TYPO3 security team on a fix
2014-06-15 Vendor releases updated version which according to them
does not fix the issue
2014-10-08 TYPO3 security team says the issue is still unresolved
2014-11-04 Vendor continues to release updated versions, no response
whether the security issue is fixed
2014-11-14 CVE number assigned
2014-12-01 Advisory released


References
==========

[1] https://code.google.com/p/wfuzz/


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests, short pentests,
performed by a team of specialised IT-security experts. Hereby, security
weaknesses in company networks or products are uncovered and can be
fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security-related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at
https://www.redteam-pentesting.de.

--
RedTeam Pentesting GmbH Tel.: +49 241 510081-0
Dennewartstr. 25-27 Fax : +49 241 510081-99
52068 Aachen https://www.redteam-pentesting.de
Germany Registergericht: Aachen HRB 14004
Geschäftsführer: Patrick Hof, Jens Liebchen
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close