CouchCMS 1.4.5 Cross Site Scripting / Open Redirect

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: CouchCMS 1.4.5  
Fixed in: 1.4.7  
Fixed Version Link: http://www.couchcms.com/products/  
Vendor Website: http://www.couchcms.com/  
Vulnerability Type: XSS & Open Redirect  
Remote Exploitable: Yes  
Reported to vendor: 11/17/2015  
Disclosed to public: 12/21/2015  
Release mode: Coordinated Release  
CVE: n/a  
Credits Tim Coen of Curesec GmbH  
  
2. Overview  
  
CVSS  
  
Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N  
  
Description  
  
CouchCMS 1.4.5 contains two reflected XSS and one open redirect vulnerability.  
  
Successful exploitation may lead to the injection of JavaScript keyloggers, the  
stealing of cookies, or the bypassing of CSRF protection.  
  
3. Details  
  
XSS 1  
  
When displaying a post, the name of any additional GET parameters is echoed  
unencoded, leading to XSS.  
  
Proof of Concept:  
  
  
http://localhost/CouchCMS-1.4.5/blog.php?p=5&foo"><script>alert(2)</script>bar=1  
  
Code:  
  
  
function getPaginationString( $page = 1, $totalitems, $limit = 15, $adjacents = 1, $targetpage = "/", $pagestring = "?page=", $prev_text, $next_text, $simple ){  
[...]  
$pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>";\  
[...]  
$pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>";  
[...]  
$pagination .= "<a href=\"" . $targetpage . $pagestring . $lpm1 . "\">$lpm1</a>";  
$pagination .= "<a href=\"" . $targetpage . $pagestring . $lastpage . "\">$lastpage</a>";  
[... (all $targetpage . $pagestring are affected) ...]  
}  
  
XSS 2  
  
When displaying comments, the name of any additional GET parameters is echoed  
unencoded, leading to XSS.  
  
Proof of Concept:  
  
  
http://localhost/CouchCMS-1.4.5/couch/?o=comments&foo"><script>alert(1)</script>bar=1  
  
Code:  
  
  
/couch/edit-comments.php  
<ul class="filter">  
<li><a <?php if(is_null($approved)) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>"><?php echo $FUNCS->t('all'); ?></a> | </li>  
<li><a <?php if($approved===0) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=0"><?php echo $FUNCS->t('unapproved'); ?> </a> | </li>  
<li><a <?php if($approved==1) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=1"><?php echo $FUNCS->t('approved'); ?></a></li>  
<?php  
if( $page_title ){  
echo '<li> (of <b><i>'.$page_title.'</i></b>)</li>';  
}  
?>  
</ul>  
  
[...]  
  
<p class="comment-actions">  
<a title="<?php echo $text_approve; ?>" href="<?php echo $approve_link; ?>"><?php echo $text_approve; ?></a> |  
<?php if( $rec['approved'] ){ ?>  
<a title="<?php echo $FUNCS->t('view'); ?>" href="<?php echo $comment_link; ?>" target="_blank"><?php echo $FUNCS->t('view'); ?></a> |  
<?php } ?>  
<a title="<?php echo $FUNCS->t('edit'); ?>" href="<?php echo $edit_link; ?>"><?php echo $FUNCS->t('edit'); ?></a> |  
<a title="<?php echo $FUNCS->t('delete'); ?>" onclick="return confirm('<?php echo $FUNCS->t('confirm_delete_comment'); ?>');" href="<?php echo $delete_link; ?>"><?php echo $FUNCS->t('delete'); ?></a>  
</p>  
  
Open Redirect  
  
The filter which checks if a user supplied redirect value leads to external  
pages can be bypassed by an attacker.  
  
Proof of Concept (Only works for logged in victims or after login):  
  
  
http://localhost/CouchCMS-1.4.5/couch/login.php?redirect=//google.com  
  
Code:  
  
  
/couch/auth/auth.php  
function redirect( $dest ){  
global $FUNCS, $DB;  
  
// sanity checks  
$dest = $FUNCS->sanitize_url( trim($dest) );  
if( !strlen($dest) ){  
$dest = ( $this->user->access_level < K_ACCESS_LEVEL_ADMIN ) ? K_SITE_URL : K_ADMIN_URL . K_ADMIN_PAGE;  
}  
elseif( strpos(strtolower($dest), 'http')===0 ){  
if( strpos($dest, K_SITE_URL)!==0 ){ // we don't allow redirects external to our site  
$dest = K_SITE_URL;  
}  
}  
  
$DB->commit( 1 );  
header( "Location: ".$dest );  
die();  
}  
  
4. Solution  
  
To mitigate this issue please upgrade at least to version 1.4.7:  
  
http://www.couchcms.com/products/  
  
Please note that a newer version might already be available.  
  
5. Report Timeline  
  
11/17/2015 Informed Vendor about Issue  
11/18/2015 Vendor sends fixes for confirmation  
11/20/2015 Verified fixes  
11/24/2015 Vendor releases fix  
12/21/2015 Disclosed to public  
  
  
Blog Reference:  
https://blog.curesec.com/article/blog/CouchCMS-145-XSS-amp-Open-Redirect-126.html  
  
--  
blog: https://blog.curesec.com  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Romain-Rolland-Str 14-24  
13089 Berlin, Germany  
  
  
`