e107 2.0 Alpha2 Cross Site Request Forgery Vulnerability

Advisory: CSRF vulnerability in CMS e107 v.2 alpha2
Author: Steffen Rösemann
Affected Software: CMS e107 v.2 alpha2 (Release-Date: 08th-Jun-2014)
Vendor URL: http://e107.org
Vendor Status: solved
CVE-ID: -

==========================
Vulnerability Description:
==========================

The Content Management System e107 v.2 alpha2 allows an attacker to become
an administrative user (without rights) when tricking the admin into
executing a CSRF-vulnerable URL including the attackers user-id.

==================
Technical Details:
==================

The administrative backend of e107 v.2 alpha2 provides the functionality to
put a user instant in the administrators group by using the following url
when the administrator is already logged in:

http://{DOMAIN/HOSTNAME}/e107_admin/users.php?mode=main&action=admin&id={ID}

An attacker could try to abuse this in convincing the admin to execute a
link which contains the id of the attackers user-account or trick him to go
on a page the attacker controls where this URL is opened (e.g. in a hidden
iframe) while the admin is logged in.

The attacker knows his own id because it is shown on his user profile:

http://{DOMAIN/HOSTNAME}/user.php?id.{ID}

Although the attacker would not instant gain any rights it is a security
issue.

Combined with clickjacking and/or other social engineering attacks this
issue could be expanded to gain such elevated rights.

=========
Solution:
=========

Install the latest patch from the github repository (see below).


====================
Disclosure Timeline:
====================
22-Dec-2014 – found the vulnerability
22-Dec-2014 - informed the developers
26-Dec-2014 – release date of this security advisory [without technical
details]
27-Dec-2014 – vendor responded and provided a patch
28-Dec-2014 – release date of this security advisory
28-Dec-2014 – post on Bugtraq / FullDisclosure

#  0day.today [2018-01-02]  #