full-disclosure - L-Forum XSS and upload spoofing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.21.0208140049470.10842-100000@Tempo.Update.UU.SE>
From: ulfh at update.uu.se (Ulf Harnhammar)
Subject: L-Forum XSS and upload spoofing

L-Forum XSS and upload spoofing

PROGRAM: L-Forum
VENDOR: Leszek Krupinski <leszek@....net>
HOMEPAGE: http://l-forum.x-php.net/
VULNERABLE VERSIONS: 2.4.0, possibly others
IMMUNE VERSIONS: none, but an official patch is available for
                 some issues
SEVERITY: high
LOGIN REQUIRED: no

DESCRIPTION:

"L-Forum is [a] universal Web forum written in PHP. It has support
for threading, multiple languages, and the PostgreSQL/MySQL database
server. You can also easily change its design, or even change design
on-the-fly with themes support."

(direct quote from the program's project page at Freshmeat)

L-Forum is published under the terms of the GNU General Public
License.

SUMMARY:

L-Forum has got two different XSS (Cross-Site Scripting) holes,
allowing attackers to add JavaScript code to messages that they post
in a forum. It has also got an upload spoofing hole, indirectly
allowing an attacker to download any file on the server that the
httpd daemon can read.

TECHNICAL DETAILS:

1) If "Enable HTML in messages" is set to on in L-Forum
Administration, the users are exposed to several XSS (Cross-Site
Scripting) holes every time they read a message. If it is on, all
parts of a message (the From, E-Mail, Subject and Body fields)
may contain all kinds of HTML code, including script tags that
execute some JavaScript code, or even worse, meta http-equiv tags
that redirect you to Gobbles' homepage.

2) When "Enable HTML in messages" is set to off in L-Forum
Administration, HTML code is only removed from the Body, and not
from the From, E-mail and Subject fields.

3) The file upload function allows uploads to occur, without checking
if the four global variables with information about an upload
(attachment, attachment_name, attachment_size and attachment_type)
really were set by uploading a file or if they were normal POST
data. This means that it can be fooled into treating any file that
the web server can read (like /etc/passwd) as the uploaded file.

COMMUNICATION WITH VENDOR:

The vendor was contacted on the 9th of July. He replied very quickly,
and posted an official patch that fixes problems number 2 and 3,
but not number 1, on the program's homepage. There is no official
new release yet, but if you apply the patch and turn off "Enable
HTML in messages" in L-Forum Administration, you are immune to all
three holes.

// Ulf Harnhammar
ulfh@...ate.uu.se