WoltLab Burning Board (wBB) 'sid' or 'wbb2_lastvisit' Cookie Parameters Permit Session Fixation Attacks
|
|
SecurityTracker Alert ID: 1016572
|
|
SecurityTracker URL: http://securitytracker.com/id?1016572
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Jul 25 2006
|
Impact: Modification of user information
|
Exploit Included: Yes
|
Version(s): 2.2.2 and prior versions
|
Description: A vulnerability was reported in WoltLab Burning Board (wBB). A remote user can conduct session fixation attacks.
If register_globals is enabled, a remote user can set a specially crafted cookie value to set the target user's session data to a
predefined value. In versions 1.x, the 'sid' variable can be set. In versions 2.x, the 'wbb2_lastvisit' variable can be set to
a predefined value.
Once the target user accesses the target web site using the predefined values, the remote user can hijack
the session.
The parameter values must be set on the target user's system (using another vulnerability, for example).
The
original advisory is available at:
http://www.majorsecurity.de/advisory/major_rls26.txt
David Vieira-Kurz of MajorSecurity
discovered this vulnerability.
|
Impact: A remote user can conduct session fixation attacks.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.woltlab.com/ (Links to External Site)
|
Cause: Authentication error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: admin@majorsecurity.de
|
Message History:
None.
|
Source Message Contents
|
Date: 23 Jul 2006 10:24:08 -0000
From: admin@majorsecurity.de
Subject: [MajorSecurity #26] Woltlab Burning Board - Multiple Cookie
|
[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnera
bilities
----------------------------------------------------------------------------------------
Software: Woltlab Burning board
Impact: Cookie manipulation and Session Fixation
Made public: July, 23th 2006
Vendor: WoltLab GmbH
Page: http://www.woltlab.de
Credits:
----------------------------------------------
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de
Original Advisory:
----------------------------------------------
http://www.majorsecurity.de/advisory/major_rls26.txt
Affected products:
-------------------------------------------------
Woltlab Burning board 1.1.1
Woltlab Burning Board 1.2
Woltlab Burning Board 2.1.3
Woltlab Burning Board 2.1.5
Woltlab Burning Board 2.2
Woltlab Burning Board 2.2.1
Woltlab Burning Board 2.2.2
Other versions may also be affected...
Requirements:
-------------------------------------------------
register_globals = On
Cookie manipulation and session fixation attack:
-------------------------------------------------
Classification:
Session Fixation is an attack technique that forces a user's session ID to an explicit value.
Depending on the functionality of the target web site, a number of techniques can be utilized to "
fix" the session ID value.
These techniques range from Cross-site Scripting exploits to peppering the web site with previously m
ade HTTP requests.
After a user's session ID has been fixed, the attacker will wait for them to login.
Once the user does so, the attacker uses the predefined session ID value to assume their online ident
ity.
Vulnerability:
-------------------------------------------------
WBB 1.1.1 and 1.2:
The Cookie variable "sid" can be set to something like:
1. <meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>;sthreads=a%253A1%253A%257Bi
%253A0%253BN%253B%257D
2. sid=>'><script>alert(123456789)</script>;sthreads=a%253A1%253A%257Bi%253A0%253B
N%253B%257D // XSS is possible
3. Cookie: sid='";sthreads=a%253A1%253A%257Bi%253A0%253BN%253B%257D // SQL-Injection could be p
ossible
WBB 2.1.x and 2.2.x:
The Cookie variable "wbb2_lastvisit" can be set to something like:
Cookie: wbb2_cookiehash=0bb23efeb1a979d68027994ecb29fc48;wbb2_lastvisit=>'><script>alert(
123456789)</script>;wbb2_hidecats=a%253A1%253A%257Bi%253A19%253Bi%253A0%253B%257D
// XSS is possible
Cookie: wbb2_cookiehash=0bb23efeb1a979d68027994ecb29fc48;wbb2_lastvisit=%00';wbb2_hidecats=a%253A1%25
3A%257Bi%253A19%253Bi%253A0%253B%257D
Solutions:
-------------------------------------------------
1. Do not accept session identifiers from GET / POST variables:
Session identifiers in URL (query string, GET variables) or POST variables are not recommended as it
simplifies this attack - it
is easy to make links or forms which sets GET / POST variables.
2.Regenerate SID on each request:
A powerful countermeassure against session fixation is to "regenerate" session identifier
(SID) on each request.
This means that although attacker may trick a user into accepting a known SID, the SID will be inval
id when attacker attempts to
re-use the SID.
3. Accept only server generated SID:
One way to improve security is to not accept session identifiers not generated by server.
if ( ! is_set( $_SESSION['SERVER_GENERATED_SID'] ) ) {
session_destroy(); // destroy all data in session
}
session_regenerate_id(); // generate a new session identifier
$_SESSION['SERVER_GENERATED_SID'] = true;
References:
-------------------------------------------------
http://www.acrossecurity.com/papers/session_fixation.pdf
http://www.webappsec.org/projects/threat/classes/session_fixation.shtml
http://en.wikipedia.org/wiki/Session_fixation
|
|
