bugtraq - ECHU.ORG Alert # 5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 29 Feb 2004 12:22:6 +0100
From: "ECHU.ORG" <contact@...u.org>
To: vulnwatch@...nwatch.org <vulnwatch@...nwatch.org>
Cc: bugtraq@...urityfocus.com <bugtraq@...urityfocus.com>
Subject: ECHU.ORG Alert # 5 - FreeBB.com

----------------------
| ECHU.ORG Alert # 5 |
----------------------

PROGRAM : Free-BB
VULNERABLE VERSIONS : forum and goldbook's current version
IMMUNE VERSIONS : none
SEVERITY : high

Tested version
==============
Current version of the goldbook and forum.

Description
=========== 
Free-BB is a french provider of services to webmasters. They propose
to every webmasters to create their own goldbook or forum freely and
without any ads. The service has been launched in december 2003 and
have hundreds of users.

Issue
=====
Problems come from files Free-BB use for its forums and guestbooks.
These files contain XSS holes, an attacker can execute code since
[couleur=codecolor]text[/couleur] and [img]URL of picture[/img] have
no filters.

A badly disposed member can post a message containing code really
easily in all the forums and guestbooks created by the Free-BB service.

Details
=======
Free-BB isn't filtering ;<>*()"'] caracters. Here is an example with
the file module-livredor.php (line 42) :

$coment=preg_replace("/(\[couleur=(.*?)\])(.*?)(\[\/couleur\]
)/i", "<span style=\"color:\\2\">\\3</span>", $coment);

Here the correct code should be :

$coment=preg_replace("/(\[couleur=([#a-zA-Z0-9]*)\])(.*?)(\[\/couleur\]
)/i", "<span style=\"color:\\2\">\\3</span>", $coment);

P-o-C
=====
These two proof-of-concept will show a window that can freeze your
computer if using Internet Explorer so take care :

- [couleur=expression(alert('unsecure'))]texte[/couleur]
- [img]javascript:alert('unsecure')[/img]

Solution
========
Free-BB has been contacted, and a patch has been released two weeks
later.

Links
=====
Free-BB : http://www.free-bb.com/
Free-BB Goldbooks : http://livredor.free-bb.com/

This vulnerability's orginal paper can be found here :
http://www.echu.org/articles/alertes/echu-alert5.txt

------------------------------
David Suzanne (dAs)
das[a]echu.org
http://www.echu.org

-----------------------------------------------------------------
ECHU.ORG is not responsible for the misuse of the information we 
provide through our security advisories. These advisories are a 
service to the professional security community. In no event shall 
ECHU.ORG be liable for any consequences whatsoever arising out of 
or in connection with the use or spread of this information.
-----------------------------------------------------------------