Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    CouchCMS 1.4.5
Fixed in:            1.4.7
Fixed Version Link:  http://www.couchcms.com/products/
Vendor Website:      http://www.couchcms.com/
Vulnerability Type:  XSS & Open Redirect
Remote Exploitable:  Yes
Reported to vendor:  11/17/2015
Disclosed to public: 12/21/2015
Release mode:        Coordinated Release
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

CVSS

Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description

CouchCMS 1.4.5 contains two reflected XSS and one open redirect vulnerability.

Successful exploitation may lead to the injection of JavaScript keyloggers, the
stealing of cookies, or the bypassing of CSRF protection.

3. Details

XSS 1

When displaying a post, the name of any additional GET parameters is echoed
unencoded, leading to XSS.

Proof of Concept:


http://localhost/CouchCMS-1.4.5/blog.php?p=5&foo"><script>alert(2)</script>bar=1

Code:


function getPaginationString( $page = 1, $totalitems, $limit = 15, $adjacents = 1, $targetpage = "/", $pagestring = "?page=", $prev_text, $next_text, $simple ){
[...]
    $pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>";\
[...]
    $pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>";
[...]
    $pagination .= "<a href=\"" . $targetpage . $pagestring . $lpm1 . "\">$lpm1</a>";
    $pagination .= "<a href=\"" . $targetpage . $pagestring . $lastpage . "\">$lastpage</a>";
[... (all $targetpage . $pagestring are affected) ...]
}

XSS 2

When displaying comments, the name of any additional GET parameters is echoed
unencoded, leading to XSS.

Proof of Concept:


http://localhost/CouchCMS-1.4.5/couch/?o=comments&foo"><script>alert(1)</script>bar=1

Code:


    /couch/edit-comments.php
    <ul class="filter">
<li><a <?php if(is_null($approved)) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>"><?php echo $FUNCS->t('all'); ?></a> | </li>
<li><a <?php if($approved===0) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=0"><?php echo $FUNCS->t('unapproved'); ?> </a> | </li>
<li><a <?php if($approved==1) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=1"><?php echo $FUNCS->t('approved'); ?></a></li>
<?php
if( $page_title ){
    echo '<li>   (of <b><i>'.$page_title.'</i></b>)</li>';
}
?>
    </ul>

    [...]

<p class="comment-actions">
    <a title="<?php echo $text_approve; ?>" href="<?php echo $approve_link; ?>"><?php echo $text_approve; ?></a> |
    <?php if( $rec['approved'] ){ ?>
    <a title="<?php echo $FUNCS->t('view'); ?>" href="<?php echo $comment_link; ?>" target="_blank"><?php echo $FUNCS->t('view'); ?></a> |
    <?php } ?>
    <a title="<?php echo $FUNCS->t('edit'); ?>" href="<?php echo $edit_link; ?>"><?php echo $FUNCS->t('edit'); ?></a> |
    <a title="<?php echo $FUNCS->t('delete'); ?>" onclick="return confirm('<?php echo $FUNCS->t('confirm_delete_comment'); ?>');" href="<?php echo $delete_link; ?>"><?php echo $FUNCS->t('delete'); ?></a>
</p>

Open Redirect

The filter which checks if a user supplied redirect value leads to external
pages can be bypassed by an attacker.

Proof of Concept (Only works for logged in victims or after login):


http://localhost/CouchCMS-1.4.5/couch/login.php?redirect=//google.com

Code:


/couch/auth/auth.php
function redirect( $dest ){
    global $FUNCS, $DB;

    // sanity checks
    $dest = $FUNCS->sanitize_url( trim($dest) );
    if( !strlen($dest) ){
$dest = ( $this->user->access_level < K_ACCESS_LEVEL_ADMIN ) ? K_SITE_URL : K_ADMIN_URL . K_ADMIN_PAGE;
    }
    elseif( strpos(strtolower($dest), 'http')===0 ){
if( strpos($dest, K_SITE_URL)!==0 ){ // we don't allow redirects external to our site
    $dest = K_SITE_URL;
}
    }

    $DB->commit( 1 );
    header( "Location: ".$dest );
    die();
}

4. Solution

To mitigate this issue please upgrade at least to version 1.4.7:

http://www.couchcms.com/products/

Please note that a newer version might already be available.

5. Report Timeline

11/17/2015 Informed Vendor about Issue
11/18/2015 Vendor sends fixes for confirmation
11/20/2015 Verified fixes
11/24/2015 Vendor releases fix
12/21/2015 Disclosed to public


Blog Reference:
https://blog.curesec.com/article/blog/CouchCMS-145-XSS-amp-Open-Redirect-126.html
 
--
blog:  https://blog.curesec.com
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Romain-Rolland-Str 14-24
13089 Berlin, Germany