High-Tech Bridge Security Research Lab discovered vulnerability in Bitrix Site Manager, which can be exploited to spoof userβs identity and read, modify or delete pre-ordered items in customerβs basket.
- User Identity Spoofing in Bitrix Site Manager: CVE-2013-6788
The vulnerability exists due to insufficient verification of supplied data authenticity when displaying pre-order items in customerβs basket in the e-Store Module of Bitrix Site Manager. A remote unauthenticated user can change βBITRIX_SM_SALE_UIDβ cookie, view another userβs basket and perform certain actions, e.g. add or delete items in the basket. The e-Store Module must be installed on the system and knowledge of a valid βBITRIX_SM_SALE_UIDβ cookie is required. This value can be easily guessed using simple brute-force techniques, since the application increases its value by 1 with every new customer.
Below are exploitation instructions for this vulnerability. You will need to open two different browsers with plugins that allow cookie management.
1. Open your first browser
2. Visit the following URL http://[host]/buy/cms.php and add items to the basket.
3. You will be redirected to the following URL: http://[host]/personal/cart.php
4. Record your βBITRIX_SM_SALE_UIDβ cookie value.
5. Open your second browser and navigate to the following URL: http://[host]/personal/cart.php
6. Change the value of your βBITRIX_SM_SALE_UIDβ cookie to the one you recorded before and delete all other cookies.
7. Refresh the page http://[host]/personal/cart.php. You will see pre-ordered items of another user.