Date: Sat, 09 Aug 2008 10:21:33 -0500
From: GulfTech Security Research <security@...ftech.org>
To: bugtraq@...urityfocus.com
Cc: vuln@...unia.com
Subject: Kayako SupportSuite < 3.30.00 Multiple Vulnerabilities

##########################################################
# GulfTech Security Research              August 09, 2008
##########################################################
# Vendor : Kayako Infotech Ltd.
# URL : http://www.kayako.com/
# Version : Kayako SupportSuite < 3.30.00
# Risk : Multiple Vulnerabilities
##########################################################


Description:
Kayako SupportSuite is a very popular online eSupport
application that consists of several well known Kayako
products such as Kayako LiveResponse and Kayako eSupport.
Unfortunately there are several security issues in Kayako
SupportSuite that may allow for an attacker to gain access
to a staff account and then escalate their privileges to
administrator. These issues include Cross Site Scripting,
Script Injection, and SQL Injection. All of these issues
are resolved in Kayako SupportSuite 3.30 and users should
upgrade as soon as possible.



Cross Site Scripting:
There are a substantial number of Cross Site Scripting
issues present in Kayako SupportSuite that may allow for
an attacker to steal cookies and gain unauthorized access
to accounts.

/visitor/index.php?_m=livesupport&_a=startclientchat&sessionid="%20onload%3dalert(document.cookie)%20style=%3d

/index.php?_m=news&_a=view&filter=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Ca%20href=%22

The above url's are a couple examples the issues in action.
Some of the xss issues in SupportSuite require certain
conditions, such as the second example. It requires a certain
amount of results to be displayed, so that the pagination is
present since that's where the issue occurs.

assign\(('|"*)([a-zA-Z0-9_]*)('|"*), \$_(GET|REQUEST|POST|SERVER)

A quick grep of the Kayako SupportSuite codebase for the
above regex, which looks for gpc variables assigned directly
as a template variable, displays 28 matches in 7 files.



Script Injection:
In addition to the cross site scripting issues explained above
are some fairly dangerous script injection issues that can be
easily used to take over a staff member's account via cookie
theft just by chatting with them. For example if a malicious
user creates an account, opens a ticket, or requests a chat with
arbitrary script in their "Full Name" field then it will execute
successfully in the context of the staff members browser when they
get a chat request, print a users ticket, edit comments awaiting
approval, or edit the attackers account.

"></script><script>alert(document.cookie);</script><script>

The above example can be inserted in to the Full Name field, and
will display cookie information to the affected user whenever one
of the previously mentioned actions are taken.



SQL Injection:
There is a fairly serious blind SQL Injection issue in the staff
panel that let's a malicious staff user, or attacker who may have
for example been able to gain access to a staff account from the
previously mentioned vulnerabilities, escalate their access to
administrator via password enumeration. The only condition required
is that the ticketid must be one that is present, and that the
attacker has access to.

/staff/index.php?_m=tickets&_a=ticketactions&action=delcflink&ticketid=1&customfieldlinkid=-99' 
UNION SELECT IF(SUBSTRING(password,1, 1) = CHAR(50), BENCHMARK(1000000, 
MD5(CHAR(1))), null),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 FROM 
ss_staff WHERE staffid=1/*

If an attacker was to visit a url like the one above, he would
experience a noticeable delay on the page loading if the first
character of the staff user's hash with the id of 1 was a 2. It is
stated on the official bug tracker that "This defect was not actually
triggerable due to implementation details of a supporting function,
but could easily have become active in the future", but in the version
tested (3.20) it was very much exploitable. The above url should
suffice for anyone wanting to test if their version is vulnerable,
just remember to make sure the ticketid parameter is valid.



Solution:
The Kayako development team were fairly prompt in addressing these
issues, and fixes for all of the previously mentioned issues can be
found in the recently released 3.30 version of Kayako SupportSuite.
Users should upgrade as soon as possible.



Credits:
James Bercegay of the GulfTech Security Research Team



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00123-08092008

Powered by blists - more mailing lists