Secunia Security Advisory - Maksymilian Arciemowicz has discovered a vulnerability in phpBB, which can be exploited by malicious people to disclose sensitive information.
512d5ff9f05c5317ef00302486f73065fd88012e3d6d3fff3247d303784db684
TITLE:
phpBB "Referer" Header Session ID Disclosure
SECUNIA ADVISORY ID:
SA18693
VERIFY ADVISORY:
http://secunia.com/advisories/18693/
CRITICAL:
Less critical
IMPACT:
Hijacking, Cross Site Scripting, Exposure of sensitive information
WHERE:
>From remote
SOFTWARE:
phpBB 2.x
http://secunia.com/product/463/
DESCRIPTION:
Maksymilian Arciemowicz has discovered a vulnerability in phpBB,
which can be exploited by malicious people to disclose sensitive
information.
The problem is that the session ID is included in the "Referer" HTTP
header when sending certain requests for external avatar images and
certain BBcode referencing external web sites. This can e.g. be
exploited to disclose the administrator's session ID by tricking the
administrator into viewing a malicious user's profile containing an
external avatar image.
This is related to:
SA16868
Successful exploitation may open up for various cross-site request
forgery and cross-site scripting attacks, but requires that support
for remote avatars is enabled (not default setting).
The vulnerability has been confirmed in version 2.0.19 and has also
been reported in prior versions.
SOLUTION:
Edit the source code to ensure that the session ID is not included in
the "Referer" HTTP header in requests for external resources.
PROVIDED AND/OR DISCOVERED BY:
Maksymilian Arciemowicz
ORIGINAL ADVISORY:
http://securityreason.com/achievement_securityalert/31
OTHER REFERENCES:
SA16868:
http://secunia.com/advisories/16868/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------