HTB23160: OpenCms XSS vulnerabilities

About one month ago High-Tech Bridge Security Research Lab was discovered two cross-site scripting /XSS/ vulnerabilities in OpenCMS version 8.5.1 and they was disclosed this days as "Multiple Cross-Site Scripting (XSS) in OpenCms: CVE-2013-4600".

Descriptions of vulnerabilities:

• Exists due to insufficient sanitisation of user-supplied data in "title" HTTP GET parameter passed to "opencms/opencms/system/workplace/views/admin/admin-main.jsp" script.

• Exists due to insufficient sanitisation of user-supplied data in "requestedResource" HTTP POST parameter passed to "opencms/opencms/system/login/index.html" URL.

This issues are fixed now and solution is available: upgrade to OpenCms 8.5.2.

Softpedia: XSS and LFI Vulnerabilities Fixed in OpenX Advertising Platform

Experts from the High-Tech Bridge Security Research Lab have identified multiple vulnerabilities in OpenX, the popular advertising platform. The flaws can be exploited to execute arbitrary PHP code, launch cross-site scripting (XSS) attacks and compromise affected systems.

The first vulnerability is a Local File Inclusion (LFI) issue that can be exploited by an attacker that has administrative privileges, or by tricking a logged-in OpenX administrator to open a malicious web page that triggers a Cross-Site Request Forgery (CSRF) exploit code.

Experts have also discovered a couple of XSS vulnerabilities that can be leveraged by a remote attacker to get administrators to execute arbitrary code by tricking them into opening a specially crafter link.

The vulnerabilities, which affect Open X 2.8.10 and probably older versions, were reported to the vendor on May 8. They were addressed last week.

Additional technical details and patches are available here.

Source: Softpedia, Eduard Kovacs

SecurityWeek: OpenX Addresses New Security Flaws with Latest Update

Article by Steve Ragan:
OpenX, the open source ad serving platform, patched two flaws last week, after they were discovered by Geneva, Switzerland’s High-Tech Bridge. The platform has had several issues before, and is a favorite target of criminals operating using malvertising as an attack vector.

According to the High-Tech Bridge advisory, OpenX patched two flaws in the final days of June. The first was a file inclusion vulnerability, which if the attacker has administrative privileges, can be used to access stored files such as the webservers /etc/passwd file.

"Successful exploitation of these vulnerabilities requires administrative privileges, however they can also be exploited by a remote non-authenticated attacker via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick logged-in OpenX administrator to open a specially crafted web page with CSRF exploit code," the advisory explains.

Read Full Article at: SecurityWeek.com

Related posts:
HTB23155: OpenX PHP file inclusion & cross-site scripting
Serious vulnerabilities in OpenX ad platform expose millions to risk

Help Net Security: Serious vulnerabilities in OpenX ad platform expose millions to risk

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in OpenX, which can be exploited to execute arbitrary PHP code, perform Cross-Site Scripting (XSS) attacks and compromise vulnerable system.

Read More at Help Net Security.

HTB23155: OpenX PHP file inclusion & cross-site scripting

Multiple vulnerabilities (PHP file inclusion and cross-site scripting) in OpenX version 2.8.10 have been discovered by High-Tech Bridge Security Research Lab about 2 months ago and disclosed this week.

• Local File Inclusion in OpenX:
  Input passed via "group" HTTP GET parameter to "/www/admin/plugin-preferences.php" and "/www/admin/plugin-settings.php" scripts is not properly verified before being used in PHP 'include()' function and can be exploited to include arbitrary local files via directory traversal sequences and URL-encoded NULL byte techniques.

• Cross-Site Scripting (XSS) in OpenX:
  The vulnerabilities exists due to insufficient filtration of user-supplied data in "package" HTTP GET parameter passed to "/www/admin/plugin-index.php" and "group" HTTP GET parameter passed to "/www/admin/plugin-settings.php" scripts.

To fix this issues replace files from SVN repository as mentioned in High-Tech Bridge security advisory HTB23155: Multiple Vulnerabilities in OpenX, also diff-dile is available. Proof-of-Concept (PoC) examples also available on researcher's page.

HTB23158: Kasseler CMS multiple vulnerabilities

High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in Kasseler CMS version 2 r1223, which can be exploited to perform SQL injection, Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks and compromise vulnerable application.

SQL Injection:
Exists due to insufficient validation of "groups" HTTP POST parameter passed to "admin.php" script. A remote authenticated administrator can execute arbitrary SQL commands in application's database.

Stored Cross-Site Scripting (XSS):
Exists due to insufficient filtration of "cat" HTTP POST parameter passed to "admin.php" script. A remote attacker with privileges to create categories can permanently inject arbitrary HTML and script code into application database that will be executed in browser of every website visitor.

Сross-Site Request Forgery (CSRF):
Exists due to absence of CSRF protection mechanisms in the entire application. A remote attacker can trick logged-in administrator to visit a specially crafted webpage with CSRF exploit code. This will enable the attacker to execute arbitrary SQL queries in application's database and gain complete control over the application.

Upgrade to Kasseler CMS 2 r1232 to stay secure from this issues.

ImmuniWeb® Web Security Assessment SaaS is certified CVE and CWE Compatible

High-Tech Bridge SA, is pleased to announce that its innovative web application security assessment SaaS solution ImmuniWeb® has successfully obtained CVE and CWE Compatibility certifications from MITRE.

ImmuniWeb® is officially "CWE-Compatible" and "CWE-Compatible".

ImmuniWeb® is a unique hybrid of security vulnerabilities scanner and manual penetration testing in parallel, distributed as a SaaS (Software-as-a-Service) solution. It is inexpensive and efficient tool to assess security of your website. ImmuniWeb® Portal is a web platform from which customer can manage security assessment process from begin to end, as well as to receive assessment report in a secure manner. It enables even SMBs and private persons who are not familiar with information security to order security assessment of their website very quickly.

MITRE CVE and CWE News:
1 Product from High Tech Bridge Now Registered as Officially "CVE-Compatible"
1 Product from High Tech Bridge Now Registered as Officially "CWE-Compatible"