more.groupware Input Validation Flaws Permit Remote Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1007064
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 26 2003
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Exploit Included: Yes
Vendor Confirmed: Yes
|
Advisory: Security-Corp
|
Version(s): 0.6.7
|
Description: Security Corporation reported some input validation vulnerabilities in 'more.groupware'. A remote user can conduct cross-site scripting attacks.
It is reported that several fields on the application do not filter HTML code from user-supplied input. A remote user can create
insert specially crafted HTML so that when a target user views the message, arbitrary scripting code will be executed by the target
user's browser. The code will originate from the site running the 'more.groupware' software and will run in the security context
of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any,
associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
It is also reported that a remote authenticated user can upload files containing PHP code and then
cause them to be executed by the server.
The following notification timeline is provided:
06/20/2003 Vendor notified
06/24/2003
Response from the vendor and corrections added
06/25/2003 Security Corporation clients notified
06/26/2003 Public disclosure
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
'more.groupware' software, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
A remote authenticated user can execute arbitrary PHP code on the target server.
|
Solution: No solution was available at the time of this entry. The vendor plans to issue a new version (0.6.8) shortly, but the new version
will *not* include a fix for these security flaws. The vendor plans to release a subsequent version to fix the flaws, to be available
"as quickly as possible."
|
Vendor URL: sourceforge.net/forum/forum.php?forum_id=287716 (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: Francois SORIN <francois.sorin@security-corporation.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 26 Jun 2003 18:38:10 +0200
From: Francois SORIN <francois.sorin@security-corporation.com>
Subject: [KSA-002] Multiple Vulnerabilities In Moregroupware
|
PROGRAM: Moregroupware
HOMEPAGE: http://www.moregroupware.com/
VULNERABLE VERSIONS: 0.6.7 and prior ?
RISK: Low/Medium
IMPACT: Cross Site Scripting
RELEASE DATE: 2003-06-26
=================================================
TABLE OF CONTENTS
=================================================
1..........................................................DESCRIPTION
2..............................................................DETAILS
3.............................................................EXPLOITS
4............................................................SOLUTIONS
5...........................................................WORKAROUND
6..................................................DISCLOSURE TIMELINE
7..............................................................CREDITS
8...........................................................DISCLAIMER
9...........................................................REFERENCES
10............................................................FEEDBACK
1. DESCRIPTION
=================================================
"Some of the features that are worth being mentioned:
- Contact/address management
- Webmail
- full-featured Calendar
- ToDo management
- News
- Project management
- Some preferences for each module
- Skins based on Cascading Style Sheets"
(direct quote from http://www.moregroupware.com)
2. DETAILS
=================================================
- Cross Site Scripting :
Many exploitable bugs was found in Moregroupware which cause script
execution on client's computer.
This kind of attack known as "Cross-Site Scripting Vulnerability"
is present in many section of the web site, an attacker can input
specially crafted links and/or other malicious scripts.
- Upload files :
When you upload a file on the server you can upload some html files or
php files. You can grab or change some informations with this
possibility.
3. EXPLOIT
=================================================
- Cross Site Scripting (many pages are infected) :
http://[target]/moregroupware/modules/contact/index.php?
You can add a contact and put <script>alert();</script>, alert(); can be
replaced by a malicious script.
A dialog box is opened on the client browser.
Impact is relatively low, as this is a closed group application.
People having access should be 'trustable'.
- Upload files :
You can upload a file like file.php:
<?php
include('../../../config.inc.php');
echo $appconf['dbvendor'];
echo $appconf['dbhost'];
echo $appconf['dbuser'];
echo $appconf['dbpassword'];
echo $appconf['dbname'];
?>
And access it directly :
http://[target]/moregroupware/modules/files/store/file.php
This file is executed on the server and the information is divulged
to the hacker.
4. SOLUTIONS
=================================================
- Cross Site Scripting :
Use the function php eregi_replace to filter the input data.
5. WORKAROUND
=================================================
- Upload files :
Secure this module by replacing file extension or specify to the web
serveur not to execute this files. A better way for this problem is
to set permissions on the store/ directory so that only the webserver can
read the files. A simple fix that actually works.
6. DISCLOSURE TIMELINE
=================================================
06/20/2003 Vendor notified
06/24/2003 Response from the vendor and corrections added
06/25/2003 Security Corporation clients notified
06/26/2003 Public disclosure
7. CREDITS
=================================================
Discovered by François SORIN <francois.sorin@security-corporation.com>
8. DISLAIMER
=================================================
The information within this paper may change without notice. Use of
this information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event
shall the author be liable for any damages whatsoever arising out of
or in connection with the use or spread of this information. Any use
of this information is at the user's own risk.
9. REFERENCES
=================================================
- http://www.security-corporation.com/articles-20030626-003.html
10. FEEDBACK
=================================================
Please send suggestions, updates, and comments to:
Kereval
Immeuble Le Gallium
80, avenue des Buttes de Coesmes
35700 RENNES - FRANCE
info@kereval.com
|
|
