SEC Consult Vulnerability Lab Security Advisory < 20140430-0 > ======================================================================= title: SQL injection and persistent XSS product: Typo3 3rd party extension si_bibtex vulnerable version: si_bibtex 0.2.3 fixed version: - impact: critical homepage: http://typo3.org/extensions/repository/view/si_bibtex found: 2013-09-24 by: B. Schildendorfer SEC Consult Vulnerability Lab https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "TYPO3 is an enterprise-class, Open Source CMS (Content Management System), used internationally to build and manage websites of all types, from small sites for non-profits to multilingual enterprise solutions for large corporations." Source: http://typo3.org/about/typo3-the-cms/ Software description: --------------------- "'BibTex Publications' allows you to import Bibtex files from the front-end and store them in a sysfolder. The front-end plug-in generates list and single views of entries and provides a simple search tool. It allows also the automatic import of BibTex files" Source: http://docs.typo3.org/typo3cms/extensions/si_bibtex/0.2.3/ Business recommendation: ------------------------ By exploiting this SQL injection vulnerability, an attacker is able to gain full access to the Typo3 database. He can use this access to crack the stored backend user passwords which would then lead to a complete system compromise on success. Depending on the location where the extension is used in the web application, this may be possible by an unauthenticated attacker. It is highly recommended to uninstall the si_bibtex extension until the vulnerabilities are fixed. Vulnerability overview/description: ----------------------------------- The vulnerable plugin (si_bibtex) is used to import, export and view bibliography files used for scientific citation. Flaws in the input validation of this software lead to SQL injection and persistent cross-site scripting vulnerabilities. 1) SQL injection The bibtex "search" and "list" allows a user to display specific bibtex items. Due to insufficient input validation of a parameter, an attacker can inject into the SQL query statement. By exploiting this vulnerability, an attacker gains access to all records stored in the database with the privileges of the Typo3 database user. 2) Persistent cross-site scripting The bibtex "import" functionality is prone to persistent cross-site scripting attacks. The vulnerability can be used to include HTML or JavaScript code to the affected web page. The imported XSS code will be displayed to every user who calls the "search" or "list" functionality of this extension. Proof of concept: ----------------- No proof of concept code available due to missing solution/workaround. Vulnerable / tested versions: ----------------------------- The following version of the si_bibtex extension has been tested, which was the most recent version at the time of discovery. si_bibtex 0.2.3 Vendor contact timeline: ------------------------ 2013-11-05: Contacting vendor through security@typo3.org 2013-11-06: Got PGP key from vendor 2013-11-11: Sent the advisory 2014-02-23: Vendor: patch delayed 2014-03-13: Deadline defined for 2014-04-11 2014-04-11: Postponing release of advisory, giving Typo3 team some more time 2014-04-30: Release of security advisory, no patch available Solution: --------- No patch available. Workaround: ----------- No workaround available. Advisory URL: ------------- https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius Headquarter: Mooslackengasse 17, 1190 Vienna, Austria Phone: +43 1 8903043 0 Fax: +43 1 8903043 15 Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF B. Schildendorfer / @2014