Date: Sun, 4 Sep 2005 23:44:03 +0200
From: Andreas Beck <becka-list-bugtraq@...atec.de>
To: bugtraq@...urityfocus.com
Subject: Update: Realchat user impersonation - BSA 200506110001


Bedatec Security Advisory 200506110001
--------------------------------------

Update release 2005-09-04 - PoC code released 
                            Added workaround for /me bug
                            Updated sections marked with "##"

Discovered       : 2005-06-06
Vendor notified  : 2005-06-11
Release date     : 2005-06-23
PoC release      : around 2005-07-23
Author           : Andreas Beck <becka-sav@...atec.de>
Application      : Realchat 
Severity         : Insecure logon handling allows to impersonate any user
                   Insecure logon handling allows efficient Spambots.
                   Strange semantics of the /me command may cause minor
                   privacy breach.
Risk             : Medium (no extra privileges gained, but other users may
                   be deceived about the identity)
Vendor           : http://www.realchat.com/
Vendor status    : Vendor notified
Vendor statement : Missing feature. Will be rectified by a release that has
                   a server side user database.
Affected Versions: At least Version 3.5.1b is affected.
CVE reference    : none.


Overview:
---------

Realchat is a popular Java-Client based Chat Software used in quite some
Web communities.

Its logon-Protocol is completely unauthenticated, allowing to impersonate
any user. It is not yet clear, if it could also be exploited to gaining
administrative privileges. According to some webdesigners using the chat,
admin privileges are secured using a password mechanism. However it is
unclear how effective it is.

On a sidenote, using the "/me" command in a private chat session causes 
the Text to appear in the main Chatroom, possibly giving away private 
information.


Details:
--------

While designing an alternate chat client (the Java client is far too
heavyweight for me), I discovered, that the protocol doesn't seem to 
have any authentication.

By modifying the custom chat client to send another username, it was
possible to log on as any user.

However this kind of spoofing is often rather easy to spot, if we are
dealing with administrative accounts, as Realchat uses avatars in its 
userlist, which usually differ for admins.

However this is as well easily spoofed, as the number of the avatar
is spoofable in the same way.


Proof of concept/How to reproduce:
----------------------------------

Method 1) 

Capture the start of a Chat session.
Replay it, but replace the Username with one of the same length.
Same for the avatar number.

Details on how to do further changes (other length usernames, etc)
in the PoC-Code.


Method 2)

Use a suitable Proxy to modify the page that sets up the chat window or
save it locally and modify it. 

PoC Code:
---------

We have a simple working Chatclient that allows to use any username (even
very long names) and any avatar as well as any smiley as an avatar.
There is no support for changing rooms or starting private chat sessions
yet.

PoC code has been withheld for about three months now to allow webmasters 
using the chat to take proper precautions, if they think the threat is 
worth to bother.

### Update - 2005-09-04:
##
## PoC Code is available via 
##
## http://www.bedatec.de/download/security/realchat_PoC.tgz
##
## Please note, that it is very simple and maybe it is even vulnerable 
## to some reverse attack. Caveat emptor. I just wrote it to prove the
## feasibility of the attack.
##
## PoC for Method 2)
## 
## The chat is started by a page similar to this one:
## 
## <applet
##   archive =" RealChat.jar"
##   codebase =" ."
##   code     =" rcs.client.RealChatClient.class"
##   name     =" ChatClient"
##   width    =" 100%"
##   height   =" 100%"
##   align    =" top"
##   alt      =" Something"
##   MAYSCRIPT>
##   <param name="nick" value="yournick">
##   <param name="externalProfileURL" value="http://some.page.com/user/_USER_">
##   <param name="avatarIcon" value="4"> 
## 
## Obviously you only need to modify that page accordingly. There is nothing
## to protect the login data. 
## 
## However it is a little tricky, due to the Java security model (just saving
## the page locally won't suffice, as this will disallow connecting to the 
## chatserver), but a suitable proxy will do the trick.
##
### End update

Vendor Response:
----------------

2005-06-11 -> Realchat notified via EMail
2005-06-13 <- Realchat staff got back to me stating this is a missing
              feature and that the /me hole was fixed.
2005-06-13 -> Suggested a simple HMAC-like scheme that would require
              sniffing another users session to impersonate him.
2005-06-17 <- Realchat say they will try to implement it until they have a 
              server based authentication.

Recommendations:
----------------

None yet. The problem must be solved in the chat software. Only disabling
the chat would be a viable workaround.

Don't use /me from private chat windows. 
## You can use ":" instead, which works correctly.


Kind regards,

Andreas Beck

-- 
Andreas Beck
http://www.bedatec.de/

Powered by blists - more mailing lists