bugtraq - Typo <= 5.1.3 Multiple Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <579210b50810311121y4dedf8d1q8536cba52213865d@mail.gmail.com>
Date: Fri, 31 Oct 2008 19:21:35 +0100
From: L4teral <l4teral@...il.com>
To: bugtraq@...urityfocus.com
Subject: Typo <= 5.1.3 Multiple Vulnerabilities

======================================================================
Typo <= 5.1.3 Multiple Vulnerabilities
======================================================================

Author:          L4teral <l4teral [at] gmail com>
Impact:          Cross Site Scripting
                 SQL Injection
                 Insecure password hash salt
Status:          patch not available

------------------------------
Affected software description:
------------------------------

Application:     Typo
Version:         <= 5.1.3
Vendor:          http://typosphere.org

Description:
Typo is a blogging engine developped with the Ruby on Rails framework.

--------------
Vulnerability:
--------------

1. The feedback system is vulnerable to cross site scripting.
   Script code can be embedded into the "Name" and "Website" fields
   when posting a new comment. If the comments are viewed in the admin
   panel, the code gets executed in the context of the admin user.
   The code embedded in the website paramter also gets executed when
   viewing the blog post as normal user.

2. The "Manage pages" part of the administration panel is prone to
   SQL injection. The parameter "published_at" is not properly
   sanitized due to an erroneous regular expression.
   "Blog publisher" rights are needed to exploit this issue.

3. The application uses a salt when storing the password hashes, but
   the salt is set to a hardcoded value making the salt less efficient
   as equal passwords result in the same hash value.

---------
Timeline:
---------

2008-09-29 - vendor informed
2008-10-02 - vendor informed
2008-10-30 - no response from vendor, public disclosure