bugtraq - [KIS-2016-08] Concrete5 <= 5.7.3.1 Multiple Cross-Site Request Forgeries Vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <57729E5C.7000204@karmainsecurity.com>
Date: Tue, 28 Jun 2016 17:57:16 +0200
From: Egidio Romano <research@...mainsecurity.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org
Subject: [KIS-2016-08] Concrete5 <= 5.7.3.1 Multiple Cross-Site Request Forgeries
 Vulnerabilities

--------------------------------------------------------------------------
Concrete5 <= 5.7.3.1 Multiple Cross-Site Request Forgeries Vulnerabilities
--------------------------------------------------------------------------

[-] Software Link:

https://www.concrete5.org/

[-] Affected Versions:

Version 5.7.3.1 and probably other versions.

[-] Vulnerabilities Description:

Concrete5 implements a Synchronizer Token Pattern in order to provide anti-CSRF capabilities.
However, the application fails to properly use this feature in every block or dashboard page
which makes a system state change, such as settings modification. As a result, the application
is vulnerable to some Cross-Site Request Forgery (CSRF) attacks:

1) File Manager - Delete: an attacker might force an authenticated user to delete files from
the File Manager by tricking the victim into browsing to a specially crafted web page.

2) Public Registration Settings: an attacker might force an authenticated user to change the
Public Registration Settings by tricking the victim into browsing to a specially crafted web page.

3) Public Profiles Settings: an attacker might force an authenticated user to change the Public
Profiles Settings by tricking the victim into browsing to a specially crafted web page.

4) Authentication Types Settings: an attacker might force an authenticated user to enable or
disable an authentication type, or change its settings by tricking the victim into browsing
to a specially crafted web page.

5) Community Points: an attacker might force an authenticated user to assign points to arbitrary
users, or add, delete, and edit Community Points Actions by tricking the victim into browsing to
a specially crafted web page.

6) Translation Site Interface: an attacker might force an authenticated user to save arbitrary
translation strings by tricking the victim into browsing to a specially crafted web page.

7) Add / Remove Group: an attacker might force an authenticated user to add/remove an arbitrary
user to/from a group by tricking the victim into browsing to a specially crafted web page.

8) Community Connect: an attacker might force an authenticated user to change tokens used to
connect to the marketplace by tricking the victim into browsing to a specially crafted web page.

[-] Solution:

Update to a fixed version.

[-] Disclosure Timeline:

[05/05/2015] - Vulnerabilities details sent through HackerOne
[02/10/2015] - CVE number requested
[28/12/2015] - Vendor said the vulnerabilities should be fixed in the upstream
[26/06/2016] - Vulnerabilities publicly disclosed on HackerOne
[28/06/2016] - Publication of this advisory

[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has not assigned a CVE identifier for these vulnerabilities.

[-] Credits:

Vulnerabilities discovered by Egidio Romano.

[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-08

[-] Other References:

https://hackerone.com/reports/59660