Anchor CMS 0.9.2: XSS Security Advisory – Curesec Research Team 1. Introduction Affected Product: Anchor CMS 0.9.2 Fixed in: not fixed Fixed Version Link: n/a Vendor Contact: Website: http://anchorcms.com/ Vulnerability Type: XSS and Open Redirect Remote Exploitable: Yes Reported to vendor: 07/30/2015 Disclosed to public: 09/14/2015 Release mode: Full Disclosure CVE: n/a Credits Tim Coen of Curesec GmbH 2. Vulnerability Description Various components of Anchor CMS are vulnerable to cross site scripting. With this, it is possible to inject and execute arbitrary JavaScript code. This can for example be used by an attacker to inject a JavaScript keylogger, bypass CSRF protection, or perform phishing attacks. The attacks can be exploited by getting the victim to click a link or visit an attacker controlled website. XSS 1 The 404 error page of Anchor CMS outputs the URL that was visited. It uses REQUEST_URI to do this, which can generally be considered reasonably secure as most modern browsers URL encode it. However, it then decodes it, opening it up for XSS. Sample POC: http://localhost/anchor-cms-0.9.2/test Code: /themes/default/404.php:6

Unfortunately, the page / could not be found. /anchor/functions/helpers.php:34 function current_url() { return Uri::current(); } /system/uri.php:81 public static function current() { if(is_null(static::$current)) static::$current = static::detect(); return static::$current; } [...] public static function detect() { [...] return static::format($uri, $server); [...] } [...] public static function format($uri, $server) { // Remove all characters except letters, // digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=. $uri = filter_var(rawurldecode($uri), FILTER_SANITIZE_URL); // remove script path/name $uri = static::remove_script_name($uri, $server); // remove the relative uri $uri = static::remove_relative_uri($uri); // return argument if not empty or return a single slash return trim($uri, '/') ?: '/'; } XSS / Open Redirect The default theme of Anchor CMS echoes the given URL inside HTML tags. less-than and greater-than are properly encoded to protect against XSS, but quotes are not encoded as ENT_NOQUOTES is used. This makes it possible to break out of the context of the given attribute and add further attributes. The improper encoding of the URL leads to an Open Redirect vulnerability which may aid in phishing attacks. Additionally, it may lead to XSS in older browsers. Sample POC: Open Redirect: http://localhost/anchor-cms-0.9.2/search/foo;url=http://google.com" HTTP-EQUIV="refresh" It is also possible to inject a style attribute and thus gain XSS via for example expression(), but this will only work for older browsers. For some browsers it will also be possible to inject JavaScript via the url parameter: http://localhost/anchor-cms-0.9.2/search/foo;url=javascript:alert(1);" HTTP-EQUIV="refresh" Code: /themes/default/header.php:29 /system/helpers:78 function e($str, $quotes = ENT_NOQUOTES) { return htmlspecialchars($str, $quotes, Config::app('encoding'), false); } XSS (User) It can be considered dangerous to let normal users post scripts, as this leads to persistent XSS, which can easily bypass CSRF protection, and thus a user could for example elevate their priviledge level to admin. XSS (Comments) Once comments are approved, they are not encoded anymore. It might be easy for an attacker to hide for example from an inexperienced user inside a large comment with lots of HTML. This would load a remote script, in which an attacker can perform the actual attack. 3. Solution This issue was not fixed by the vendor. 4. Report Timeline 07/21/2015 Informed Vendor about Issue (no reply) 08/18/2015 Reminded Vendor of release date (no reply) 09/14/2015 Disclosed to public 5. Blog Reference: http://blog.curesec.com/article/blog/Anchor-CMS-092-XSS-53.html