bugtraq - feedsplitter considered harmful

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060830200927.13708.qmail@securityfocus.com>
Date: 30 Aug 2006 20:09:27 -0000
From: jon@...ck.us
To: bugtraq@...urityfocus.com
Subject: feedsplitter considered harmful

I was looking through the feedsplitter.php script avaiable from http://chxo.com/software/feedsplitter/, version 2006-01-21 (revision 1.7 according to the RCS $Id$, but that looks out of date) today, and noticed a few problems.  (Background: feedsplitter turns RSS feeds into HTML or javascript so you can easily embed them in non-dynamic sites.)

First, it has a "showsource" function, that discloses its source code to anyone on the Internet.  That's probably OK if you haven't made any confidential modification, but certainly not something that much software has built in.

Next, it allows a "format" to be specified in the URL query string.  This "format" is used to open an XML file named "$format.xml".  $format is checked for "."s in the filename, but if there is a dot in position 0, the check fails and filenames like "../../../../../confidential/data" are passed through and opened. (The name does have .xml appended, though, so you can only read confidential XML files).  

Next, this arbitrary XML file is eval()'d a number of times.  If file uploads are allowed to a server running this script, anyone can execute arbitrary PHP code.  That's a slight security problem, I think :)

Continuing, it appears that the fetched RSS feed from the untrusted Internet is also eval()'d a few times.  I'm not sure if code execution can happen or not -- there's some weird "stripslashes(addslashes($data))" going on.  I would think that's a NOP, but I'm a Perl Monger, not a PHP hacker, so I don't know what this is doing.  Anyway, potentially a problem.

Finally, it appears that any malicious HTML in the RSS feed is passed through, allowing an RSS administator to steal cookies (XSS, etc.) from any site that incorporates the output of feedsplitter.  It looks like the feed is being put through "addslashes", but I don't think that escapes HTML.  I haven't tested this, though, so YMMV.

Anyway, I recommend that you avoid this script until the above issues have been resolved.

Regards,
Jonathan Rockway