Kajona 4.7: XSS & Directory Traversal

Date: 2016-09-15 15:50:41

1. Introduction

2. Overview

Kajona is an open source CMS written in PHP. In version 4.7, it is vulnerable to multiple XSS attacks and limited directory traversal.

The XSS vulnerabilities are reflected as well as persistent, and can lead to the stealing of cookies, injection of keyloggers, or the bypassing of CSRF protection.

The directory traversal issue gives information about which files exist on a system, and thus allows an attacker to gather information about a system.

3. Details

XSS 1: Reflected XSS

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

The function that parses admin requests echoes user input into a JavaScript context without escaping, leading to reflected XSS. As the injection takes place into a JavaScript context, browser filters will generally not be able to filter out an attack.

In the case of Kajona, XSS may lead to code execution, as admins can upload PHP files via the media manager.

Proof of Concept:

Code:

XSS 2: Reflected XSS

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

The media manager echoes the form_element parameter into a JavaScript context without escaping, leading to reflected XSS. As the injection takes place into a JavaScript context, browser filters will generally not be able to filter out an attack. Note that a valid systemid id is required.

Proof of Concept:

XSS 3: Reflected XSS

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

The "class_messageprovider_exceptions_enabled" parameter of the xml.php script is vulnerable to reflected XSS.

Proof of Concept:

XSS 4: Persistent XSS

CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

When creating a comment, the subject is vulnerable to persistent XSS. The click of an admin is required to execute the injected JavaScript code.

Proof of Concept:

Directory Traversal

When viewing images, the file name is improperly sanitized, allowing for directory traversal.

It is not possible to actually read out files, as there are additional checks in place preventing that. But an unauthenticated attacker can still see which files exist on a system and which do not, making it possible to collect information for further attacks.

Proof of Concept:

Code:

4. Solution

To mitigate this issue please upgrade at least to version 5.0:

https://www.kajona.de/en/Downloads/downloads.get_kajona.html

Please note that a newer version might already be available.

5. Report Timeline