SPIP 3.1 Cross Site Scripting / Header Injection

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected SPIP 3.1  
Product:  
Fixed in: 3.1.2 / 3.0.23  
Fixed Version http://www.spip.net/en_download  
Link:  
Vendor Website: http://www.spip.net/  
Vulnerability Reflected & Persistent XSS, Host Header Injection, httpOnly  
Type: Cookie disclosure  
Remote Yes  
Exploitable:  
Reported to 09/05/2016  
vendor:  
Disclosed to 11/10/2016  
public:  
Release mode: Coordinated Release  
CVE: n/a  
Credits Tim Coen of Curesec GmbH  
  
2. Overview  
  
SPIP is a content management system written in PHP. In version 3.1, it is  
vulnerable to a persistent as well as reflected cross site scripting  
vulnerability as it allows users to enter URLs containing the JavaScript  
protocol, which an attacker can exploit to steal cookies, inject JavaScript  
keylogger, or bypass CSRF protection. Additionally, it contains a Host Header  
Injection which may lead to the leakage of password reset tokens and thus the  
compromisation of user accounts. Finally, the application discloses httpOnly  
cookies, making exploitation of XSS issues slightly easier.  
  
3. Details  
  
Persistent XSS  
  
CVSS: Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N  
  
Description: When posting a message in the internal Forum, user input is  
properly encoded, thus disallowing XSS. However, a hypertext link may be added  
as well, and there is no check on the protocol of the supplied link, which  
leads to an XSS vulnerability.  
  
Proof of Concept:  
  
1. Create a new Message: http://localhost/spip/ecrire/?exec=forum&repondre=new  
2. In the URL field enter: javascript:alert(1) 3. Post the Message To trigger  
the payload, a click on the link is required.  
  
Reflected XSS  
  
CVSS: Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N  
  
Description: When editing a private message, a redirect parameter may be  
submitted as well. This parameter decides to what page a user is returned if  
they were to press the back button. The value of this parameter is user  
controlled and may thus be used for phishing or XSS attacks.  
  
Proof of Concept:  
  
Visit: http://localhost/spip/ecrire/?exec=message_edit&new=oui&to=2&redirect=  
javascript:alert(1) Click on the Back button represented by the envelope icon.  
  
Host Header Injection  
  
CVSS: Low 2.6 AV:N/AC:H/Au:N/C:P/I:N/A:N  
  
Description:  
The application takes the Host Header and uses it in a password reset email. As  
the Host Header is user-controlled, an attacker can set it to arbitrary values.  
  
In the case of a password reset page, this can lead to security issues as an  
attacker can request a password reset email for a user and set the Host header  
to a server they control. As this header is used in the email, a user would be  
send to the attackers server if they were to click on the link, leading to the  
leakage of the recovery token and thus the compromisation of the account.  
  
Proof of Concept:  
  
Request: POST /spip/spip.php?page=spip_pass&lang=en HTTP/1.1 Host: example.com  
Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie:  
spip_accepte_ajax=1; spip_admin=%40admin; PHPSESSID=1l8rvbhcgia45ddj7ldoc1gpf6;  
wb-installer=3d2hes1b6i0bfb586iucm76sp2; wb-4174-sid=u571gr7isplq8b4f01fniqevk2  
Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/  
x-www-form-urlencoded Content-Length: 199 page=spip_pass&lang=en&  
formulaire_action=oubli&formulaire_action_args=  
orESpF0vSC3Q%2BB30uGEFqT7k6AcDObDMasMNzVp3EjndtlvZ%2B5k4g%2FkyF%2BAlzhBhCI%2F%2F9hx%2FZ33mkQPk  
&oubli=visitor%40example.com&nobot= Email Send: [My SPIP site] Forgotten  
password (this is an automated message) To recover your access to the site My  
SPIP site (http://localhost/spip) Please go to the following address: http://  
example.com/spip/spip.php?page=spip_pass&p=107017475657c15ad6e9c781.23674073  
You can then enter a new password and log in to the site.  
  
httpOnly Cookie Disclosure  
  
Description: The phpinfo page discloses httpOnly cookies such as session  
cookies, making it slightly easier to exploit XSS vulnerabilities.  
  
Proof of Concept:  
  
http://localhost/spip/ecrire/?exec=info  
  
4. Solution  
  
To mitigate this issue please upgrade at least to version 3.1.2:  
  
http://www.spip.net/en_download  
  
Please note that a newer version might already be available.  
  
5. Report Timeline  
  
09/05/2016 Informed Vendor about Issue  
09/23/2016 Vendor releases fix  
11/10/2016 Disclosed to public  
  
  
Blog Reference:  
https://www.curesec.com/blog/article/blog/SPIP-31-XSS-amp-Host-Header-Injection-178.html  
  
--  
blog: https://www.curesec.com/blog  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Josef-Orlopp-StraAe 54  
10365 Berlin, Germany  
  
  
`