SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   GuppY Vendors:   Duveau, Laurent
GuppY Input Validation Flaw in Colorcode Tag Permits Remote Cross-Site Scripting Attacks
SecurityTracker Alert ID:  1007847
SecurityTracker URL:  http://securitytracker.com/id/1007847
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Oct 1 2003
Impact:   Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): prior to 2.4p1
Description:   An input validation vulnerability was reported in GuppY. A remote user can conduct cross-site scripting attacks.

It is reported that the 'postguest.php' file does not filter HTML code from user-supplied input in certain variables. In particular, the codecolor '[c]' tag is not filtered.

A remote user can submit specially crafted message content so that when a target user views the portal message, arbitrary scripting code will be executed by the target user's browser. The code will originate from the site running the vulnerable GuppY software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A demonstration exploit message contents is provided:

[c=expression(alert('unsecure'))]texte[/c]

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the GuppY portal software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
Solution:   The vendor has released a fixed version (2.4p1), available at:

http://www.freeguppy.org/file/guppy.zip

A patch is also available at:

http://www.freeguppy.org/file/guppy_patch2.zip

Vendor URL:  www.freeguppy.org/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  ECHU.ORG Alert #4: GuppY makes XSS attacks easy


--------------------------------
| GuppY makes XSS attacks easy |
--------------------------------


PROGRAM: GuppY
VULNERABLE VERSIONS: All versions under 2.4p1
IMMUNE VERSIONS: 2.4p1
SEVERITY: high


Tested version
==============
GuppY 2.4 on the official GuppY website.


Description
============ 
"GuppY is a small web portal, meant to be easy to use for the end user that you are, and which does not require a database to run.This
 architecture allows then to install it on almost all Internet web sites hosters (or almost all of them), the only preriquisite being
 that your hoster has to provide the PHP scripting language facility." - GuppY website

GuppY use the postguest.php file for its forum and guestbook modules. This file contain XSS holes, an attacker can execute code since
 [c=codecolor]text[/c] has no filter.


POSTGUEST.PHP
=============
Problems come from this part:

Line 196: $ptxt = preg_replace("/(\[c=(.*?)\])(.*?)(\[\/c\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);
Line 197: $ptxt = preg_replace("/(\[c=(.*?)\])(.*?)(\[\/C\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);
Line 198: $ptxt = preg_replace("/(\[C=(.*?)\])(.*?)(\[\/c\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);
Line 199: $ptxt = preg_replace("/(\[C=(.*?)\])(.*?)(\[\/C\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);

A badly disposed member can post a message containing code really easily in forum and guestbook modules. Example:
(This proof-of-concept will show a window that can freeze your computer if using Internet Explorer so take care)

[c=expression(alert('unsecure'))]texte[/c]


Solution
========
In order to avoid the vulnerability, add a filter that will block ;<>*()"'] caracters to lines 196 to 199:

Line 196: $ptxt = preg_replace("/(\[c=([#a-zA-Z0-9]*)\])(.*?)(\[\/c\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);
Line 197: $ptxt = preg_replace("/(\[c=([#a-zA-Z0-9]*)\])(.*?)(\[\/C\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);
Line 198: $ptxt = preg_replace("/(\[C=([#a-zA-Z0-9]*)\])(.*?)(\[\/c\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);
Line 199: $ptxt = preg_replace("/(\[C=([#a-zA-Z0-9]*)\])(.*?)(\[\/C\])/i", "<font style=\"color:\\2\">\\3</font>",$ptxt);


Vendor status
==============
GuppY developper's team has been contacted, a patch has been released tonight that fix the problem. Thanks to aldweb (freeguppy.org
 webmaster) for his quick answer.


Links
=====
GuppY: http://www.freeguppy.org
Patch: http://www.freeguppy.org/file/guppy_patch2.zip
Version 2.4p1: http://www.freeguppy.org/file/guppy.zip


This vulnerability's orginal paper can be found here: http://www.echu.org/articles/alertes/echu-alert4.txt


David Suzanne (dAs)
das[a]echu.org
http://www.echu.org 


-----------------------------------------------------------------
ECHU.ORG is not responsible for the misuse of the information we 
provide through our security advisories. These advisories are a 
service to the professional security community. In no event shall 
ECHU.ORG be liable for any consequences whatsoever arising out of 
or in connection with the use or spread of this information.
-----------------------------------------------------------------

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, SecurityGlobal.net LLC