Security Advisory - Curesec Research Team

1. Introduction

Affected         SPIP 3.1
Product:
Fixed in:        3.1.2 / 3.0.23
Fixed Version    http://www.spip.net/en_download
Link:
Vendor Website:  http://www.spip.net/
Vulnerability    Reflected & Persistent XSS, Host Header Injection, httpOnly
Type:            Cookie disclosure
Remote           Yes
Exploitable:
Reported to      09/05/2016
vendor:
Disclosed to     11/10/2016
public:
Release mode:    Coordinated Release
CVE:             n/a
Credits          Tim Coen of Curesec GmbH

2. Overview

SPIP is a content management system written in PHP. In version 3.1, it is
vulnerable to a persistent as well as reflected cross site scripting
vulnerability as it allows users to enter URLs containing the JavaScript
protocol, which an attacker can exploit to steal cookies, inject JavaScript
keylogger, or bypass CSRF protection. Additionally, it contains a Host Header
Injection which may lead to the leakage of password reset tokens and thus the
compromisation of user accounts. Finally, the application discloses httpOnly
cookies, making exploitation of XSS issues slightly easier.

3. Details

Persistent XSS

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Description: When posting a message in the internal Forum, user input is
properly encoded, thus disallowing XSS. However, a hypertext link may be added
as well, and there is no check on the protocol of the supplied link, which
leads to an XSS vulnerability.

Proof of Concept:

1. Create a new Message: http://localhost/spip/ecrire/?exec=forum&repondre=new
2. In the URL field enter: javascript:alert(1) 3. Post the Message To trigger
the payload, a click on the link is required.

Reflected XSS

CVSS: Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

Description: When editing a private message, a redirect parameter may be
submitted as well. This parameter decides to what page a user is returned if
they were to press the back button. The value of this parameter is user
controlled and may thus be used for phishing or XSS attacks.

Proof of Concept:

Visit: http://localhost/spip/ecrire/?exec=message_edit&new=oui&to=2&redirect=
javascript:alert(1) Click on the Back button represented by the envelope icon.

Host Header Injection

CVSS: Low 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N

Description:
The application takes the Host Header and uses it in a password reset email. As
the Host Header is user-controlled, an attacker can set it to arbitrary values.

In the case of a password reset page, this can lead to security issues as an
attacker can request a password reset email for a user and set the Host header
to a server they control. As this header is used in the email, a user would be
send to the attackers server if they were to click on the link, leading to the
leakage of the recovery token and thus the compromisation of the account.

Proof of Concept:

Request: POST /spip/spip.php?page=spip_pass&lang=en HTTP/1.1 Host: example.com
Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie:
spip_accepte_ajax=1; spip_admin=%40admin; PHPSESSID=1l8rvbhcgia45ddj7ldoc1gpf6;
wb-installer=3d2hes1b6i0bfb586iucm76sp2; wb-4174-sid=u571gr7isplq8b4f01fniqevk2
Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/
x-www-form-urlencoded Content-Length: 199 page=spip_pass&lang=en&
formulaire_action=oubli&formulaire_action_args=
orESpF0vSC3Q%2BB30uGEFqT7k6AcDObDMasMNzVp3EjndtlvZ%2B5k4g%2FkyF%2BAlzhBhCI%2F%2F9hx%2FZ33mkQPk
&oubli=visitor%40example.com&nobot= Email Send: [My SPIP site] Forgotten
password (this is an automated message) To recover your access to the site My
SPIP site (http://localhost/spip) Please go to the following address: http://
example.com/spip/spip.php?page=spip_pass&p=107017475657c15ad6e9c781.23674073
You can then enter a new password and log in to the site.

httpOnly Cookie Disclosure

Description: The phpinfo page discloses httpOnly cookies such as session
cookies, making it slightly easier to exploit XSS vulnerabilities.

Proof of Concept:

http://localhost/spip/ecrire/?exec=info

4. Solution

To mitigate this issue please upgrade at least to version 3.1.2:

http://www.spip.net/en_download

Please note that a newer version might already be available.

5. Report Timeline

09/05/2016 Informed Vendor about Issue
09/23/2016 Vendor releases fix
11/10/2016 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/SPIP-31-XSS-amp-Host-Header-Injection-178.html
 
--
blog:  https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-StraAe 54
10365 Berlin, Germany