PostNuke Input Validation Flaw in 'sortby' Variable in 'members_list' Module Permits SQL Injection
|
|
SecurityTracker Alert ID: 1008629
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jan 7 2004
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: GulfTech Security Research Team
|
Version(s): 0.726
|
Description: An input validation vulnerability was reported in PostNuke. A remote user can inject SQL commands. A remote user can also conduct cross-site scripting attacks.
JeiAr of the GulfTech Security Research Team reported that the 'members_list' module does not properly validate user-supplied input
in the 'sortby' variable. A remote user may be able to execute SQL commands on the underlying database.
It is also reported
that the download module does not filter HTML code from user supplied input in the 'ttitle' variable. A remote user can create
a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's
browser. The code will originate from the site running the PostNuke software and will run in the security context of that site.
As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with
the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the
target user.
A demonstration exploit is provided (where '[VID]' is a valid file ID number):
name=Downloads&file=index&req=viewdownloaddetails&lid=[VID]&ttitle="><i
frame>
|
Impact: A remote user can inject SQL commands on the target system.
A remote user can access the target user's cookies (including authentication
cookies), if any, associated with the site running the PostNuke software, access data recently submitted by the target user via
web form to the site, or take actions on the site acting as the target user.
|
Solution: The vendor has released the following fixes:
1. PostNuke Phoenix 0.726-1 (.tar.gz format)
http://download.postnuke.com/pafiledb.php?action=file&id=34
Size/MD5 checksum: b56a5be2e88e5d6ad779a47bb4864084
2. PostNuke Phoenix 0.726-1 (.zip format)
http://download.postnuke.com/pafiledb.php?action=file&id=33
Size/MD5 checksum: 4b5fd57053c8577eeefef50cd1d19279
3. Members_List patch for pn0.726 (.tar.gz format)
http://download.postnuke.com/pafiledb.php?action=file&id=
42
Size/MD5 checksum: 6cf971d9222821529cbf7029dcd97dcc
4. Members_List patch for pn0.726 (.zip format)
http://download.postnuke.com/pafiledb.php?action=file&i
d=41
Size/MD5 checksum: d36e5b9442a688e8348cf67a1ef21f56
The author of the report indicates that the fix corrects the SQL
injection flaw and that a future fix will correct the cross-site scripting flaw.
|
Vendor URL: lists.postnuke.com/pipermail/postnuke-security/2004q1/000001.html (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: JeiAr <security@gulftech.org>
|
Message History:
None.
|
Source Message Contents
|
Date: 2 Jan 2004 23:20:20 -0000
From: JeiAr <security@gulftech.org>
Subject: PostNuke Issues (0.726 && Possibly Older)
|
Vendor : PostNuke
URL : http://www.postnuke.com
Version : PostNuke 0.726 Phoenix && Older(??)
Risk : SQL Injection && XSS
Description:
Postnuke is a popular Open Source CMS (Content Managment System) used
by millions of people all across the world.
SQL Injection:
SQL Injection is possible by passing unexpected data to the "sortby" variable
in the "members_list" module. This vulnerability may allow an attacker to
manipulate queries as well as view the full physical path of the postnuke
installation. This is due to user input not being properly sanatized.
Cross Site Scripting:
XSS is possible via the download module by injecting HTML or Script into the
"ttitle" variable when viewing the details of an item for download. Example:
name=Downloads&file=index&req=viewdownloaddetails&lid=[VID]&ttitle="><ifra
me>
Where [VID] is should be the valid id number of a file for download.
Solution:
An update has been released regarding the SQL Injection vulnerability. The XSS
vuln however will not be fixed until future releases of PostNuke as it is really
not possible to HiJack a users postnuke session, thus limiting the chances of
this being harmful to any users or administrators. Much respect to the postnuke
Dev team and especially Andreas Krapohl aka larsneo for being very prompt and
professional about issuing a fix for this immediately. The fixed may be obtained
from the official PostNuke website at http://www.postnuke.com
Credits:
Credits go to JeiAr of the GulfTech Security Research Team.
http://www.gulftech.org
Hope everyone had a good Christmas/Hanukkah/Kwanza and a Happy New Year :o)
|
|
