Security Advisory - Curesec Research Team 1. Introduction Affected Product: LEPTON 2.2.2 stable Fixed in: 2.3.0 Fixed Version http://www.lepton-cms.org/posts/ Link: important-lepton-2.3.0-101.php Vendor Website: http://www.lepton-cms.org/ Vulnerability CSRF, Open Redirect, Insecure Bruteforce Protection & Type: Password Handling Remote Yes Exploitable: Reported to 09/05/2016 vendor: Disclosed to 11/10/2016 public: Release mode: Coordinated Release CVE: n/a Credits Tim Coen of Curesec GmbH 2. Overview Lepton is a content management system written in PHP. In version 2.2.2, it contains various low to medium impact issues. The functionality that operates on files and folders is vulnerable to CSRF which may lead to XSS, the logout is vulnerable to Open Redirect, the in-build bruteforce protection can be easily bypassed, and passwords are hashed with md5 and send out via email in plaintext. 3. Details CSRF CVSS: Medium 4.0 AV:N/AC:H/Au:N/C:N/I:P/A:P Description: All actions on folders and files are missing CSRF protection. Because of this, an attacker can delete, create, or rename folders and files. An attacker could for example create .html files which would lead to an XSS attack. Proof of Concept: Delete Folder: Create File: Open Redirect CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:NP Description: The redirect parameter of the logout script is vulnerable to open redirect. Proof of Concept: http://localhost/LEPTON_stable_2.2.2/upload/account/logout.php?redirect=http:// google.com Insufficient Bruteforce Protection Description: The bruteforce protection works on a per-session base, which is easily bypassed by an attacker by simply requesting a new session by not sending the current, locked session information. The current bruteforce protection may provide a false sense of security and should thus be removed or changed. Code: if($_SESSION['ATTEMPS'] > $this->max_attemps) { $this->warn(); } Password Handling The password reset functionality sends a newly generated password in plaintext via email, which is not recommended. Additionally, md5 is used for hashing, which is also not recommended. 4. Solution To mitigate this issue please upgrade at least to version 2.3.0: http://www.lepton-cms.org/posts/important-lepton-2.3.0-101.php Please note that a newer version might already be available. 5. Report Timeline 09/05/2016 Informed Vendor about Issue 09/06/2016 Vendor requests 60 days to release fix 10/25/2016 Vendor releases fix 11/10/2016 Disclosed to public Blog Reference: https://www.curesec.com/blog/article/blog/Lepton-222-CSRF-Open-Redirect-Insecure-Bruteforce-Protection-amp-Password-Handling-172.html -- blog: https://www.curesec.com/blog tweet: https://twitter.com/curesec Curesec GmbH Curesec Research Team Josef-Orlopp-StraAe 54 10365 Berlin, Germany