bugtraq - phpBB 2.0.13 - user level exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 7 Mar 2005 02:28:57 -0000
From: Some one <someone@...nabismail.com>
To: bugtraq@...urityfocus.com
Subject: phpBB 2.0.13 - user level exploit

This one goes for all phpBB versions up to 2.0.13. While applying and testing the patch for the autologin bug I found that phpBB2 doesn't reset the $userdata['user_level'] variable after a failed autologin.

This is the vulvernable code in sessions.php:

	if ( $user_id != ANONYMOUS )
	{
		$auto_login_key = $userdata['user_password'];

		if ( $auto_create )
		{
			if ( isset($sessiondata['autologinid']) && $userdata['user_active'] )
			{
				// We have to login automagically
				if( $sessiondata['autologinid'] === $auto_login_key )
				{
					// autologinid matches password
					$login = 1;
					$enable_autologin = 1;
				}
				else
				{
					// No match; don't login, set as anonymous user
					$login = 0; 
					$enable_autologin = 0; 
					$user_id = $userdata['user_id'] = ANONYMOUS;
				}
			}
			else
			{
				// Autologin is not set. Don't login, set as anonymous user
				$login = 0;
				$enable_autologin = 0;
				$user_id = $userdata['user_id'] = ANONYMOUS;
			}
		}
		else
		{
			$login = 1;
		}
	}
	else
	{
		$login = 0;
		$enable_autologin = 0;
	}

As you can see, if autologin fails it will reset the $userdata['user_id'] value to ANONYMOUS, but $userdata['user_level'] stays at the value of the user account that failed to login.

Now phpBB only checks for the userlevel in various locations and ignores the user_id there. So if you manipulate the "_data" cookie to send the user_id of an admin you can see some information that should only be visible to an admin. Like hidden users on the "who is online page" or email adresses from users, even if the user disallowed that, in their profiles. Maybe you can even use some admin functions, I didn't check this in depth.

The cookie manipulation will only work on the first page requestet, as the session.php will then overwrite the user_id in it, unless you prevent the browser from modifying the cookie of course.

The fix is quite simple, add $userdata['user_level'] = USER; after every $userdata['user_id'] = ANONYMOUS; in session.php.