CouchCMS 1.4.5: XSS & Open Redirect
Date: 2015-12-21 10:34:39
Security Advisory – Curesec Research Team
1. Introduction
| Affected Product: |
CouchCMS 1.4.5 |
| Fixed in: |
1.4.7 |
| Fixed Version Link: |
http://www.couchcms.com/products/ |
| Vendor Website: |
http://www.couchcms.com/ |
| Vulnerability Type: |
XSS & Open Redirect |
| Remote Exploitable: |
Yes |
| Reported to vendor: |
11/17/2015 |
| Disclosed to public: |
12/21/2015 |
| Release mode: |
Coordinated Release |
| CVE: |
n/a |
| Credits |
Tim Coen of curesec GmbH |
2. Overview
CVSS
Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
Description
CouchCMS 1.4.5 contains two reflected XSS and one open redirect vulnerability.
Successful exploitation may lead to the injection of JavaScript keyloggers, the stealing of cookies, or the bypassing of CSRF protection.
3. Details
XSS 1
When displaying a post, the name of any additional GET parameters is echoed unencoded, leading to XSS.
Proof of Concept:
http://localhost/CouchCMS-1.4.5/blog.php?p=5&foo"><script>alert(2)</script>bar=1
Code:
function getPaginationString( $page = 1, $totalitems, $limit = 15, $adjacents = 1, $targetpage = "/", $pagestring = "?page=", $prev_text, $next_text, $simple ){
[...]
$pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>";\
[...]
$pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>";
[...]
$pagination .= "<a href=\"" . $targetpage . $pagestring . $lpm1 . "\">$lpm1</a>";
$pagination .= "<a href=\"" . $targetpage . $pagestring . $lastpage . "\">$lastpage</a>";
[... (all $targetpage . $pagestring are affected) ...]
}
XSS 2
When displaying comments, the name of any additional GET parameters is echoed unencoded, leading to XSS.
Proof of Concept:
http://localhost/CouchCMS-1.4.5/couch/?o=comments&foo"><script>alert(1)</script>bar=1
Code:
/couch/edit-comments.php
<ul class="filter">
<li><a <?php if(is_null($approved)) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>"><?php echo $FUNCS->t('all'); ?></a> | </li>
<li><a <?php if($approved===0) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=0"><?php echo $FUNCS->t('unapproved'); ?> </a> | </li>
<li><a <?php if($approved==1) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=1"><?php echo $FUNCS->t('approved'); ?></a></li>
<?php
if( $page_title ){
echo '<li> (of <b><i>'.$page_title.'</i></b>)</li>';
}
?>
</ul>
[...]
<p class="comment-actions">
<a title="<?php echo $text_approve; ?>" href="<?php echo $approve_link; ?>"><?php echo $text_approve; ?></a> |
<?php if( $rec['approved'] ){ ?>
<a title="<?php echo $FUNCS->t('view'); ?>" href="<?php echo $comment_link; ?>" target="_blank"><?php echo $FUNCS->t('view'); ?></a> |
<?php } ?>
<a title="<?php echo $FUNCS->t('edit'); ?>" href="<?php echo $edit_link; ?>"><?php echo $FUNCS->t('edit'); ?></a> |
<a title="<?php echo $FUNCS->t('delete'); ?>" onclick="return confirm('<?php echo $FUNCS->t('confirm_delete_comment'); ?>');" href="<?php echo $delete_link; ?>"><?php echo $FUNCS->t('delete'); ?></a>
</p>
Open Redirect
The filter which checks if a user supplied redirect value leads to external pages can be bypassed by an attacker.
Proof of Concept (Only works for logged in victims or after login):
http://localhost/CouchCMS-1.4.5/couch/login.php?redirect=//google.com
Code:
/couch/auth/auth.php
function redirect( $dest ){
global $FUNCS, $DB;
// sanity checks
$dest = $FUNCS->sanitize_url( trim($dest) );
if( !strlen($dest) ){
$dest = ( $this->user->access_level < K_ACCESS_LEVEL_ADMIN ) ? K_SITE_URL : K_ADMIN_URL . K_ADMIN_PAGE;
}
elseif( strpos(strtolower($dest), 'http')===0 ){
if( strpos($dest, K_SITE_URL)!==0 ){ // we don't allow redirects external to our site
$dest = K_SITE_URL;
}
}
$DB->commit( 1 );
header( "Location: ".$dest );
die();
}
4. Solution
To mitigate this issue please upgrade at least to version 1.4.7:
http://www.couchcms.com/products/
Please note that a newer version might already be available.
5. Report Timeline
| 11/17/2015 |
Informed Vendor about Issue |
| 11/18/2015 |
Vendor sends fixes for confirmation |
| 11/20/2015 |
Verified fixes |
| 11/24/2015 |
Vendor releases fix |
| 12/21/2015 |
Disclosed to public |
