full-disclosure - Bypass XSS filter in PHPNUKE 7.9=>x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <200512141806.52106.max@jestsuper.pl>
Date: Wed Dec 14 17:07:41 2005
From: max at jestsuper.pl (Maksymilian Arciemowicz)
Subject: Bypass XSS filter in PHPNUKE 7.9=>x

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[Bypass XSS filter in PHPNUKE 7.9=>x cXIb8O3.21]

Author: Maksymilian Arciemowicz ( cXIb8O3 )
Date: 14.12.2005
from SECURITYREASON.COM

- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online 
community or whatever you want to call it. Its goal is to have an automated 
web site to distribute news and articles with user system. Each user can 
submit comments to discuss the articles, similar to Slashdot and many others. 
Features: web admin, polls/surveys with comment, statistics, user 
customizable box, themes manager, friendly admin GUI, moderation system, 
sections manager, banner system, backend/headlines generation, Yahoo like 
search engine, Ephemerids manager, file manager, download manager, faq 
manager, advanced blocks system, reviews system, newsletter, content 
management, encyclopedia generator, md5 password encryption, phpBB Forums 
integration, support for 25 languages, 100% modular and more. Written 100% in 
PHP and requires Apache, PHP and a SQL Database Server. Supports MySQL, 
PostgreSQL, Adabas, mSQL and many others.

- --- 1. Bypass XSS filter ---

In PHPnuke is (file includes/mainfile.php).

- -168-193---
if (!defined('ADMIN_FILE') && !file_exists('includes/nukesentinel.php')) {
  foreach ($_GET as $sec_key => $secvalue) {
    if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
	(eregi("<[^>]*body*\"?[^>]*>", $secvalue)) ||
	(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
	(eregi("\"", $secvalue)) ||
	(eregi("forum_admin", $sec_key)) ||
	(eregi("inside_mod", $sec_key))) {
        die ($htmltags);
     }
  }

  foreach ($_POST as $secvalue) {
    if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || 
(eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", 
$secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
      die ($htmltags);
    }
  }
}
- -168-193---

This functions deletes from input html tags like:

	- <script>
	- <object>
	- <iframe>
	- <applet>
	- <meta>
	- <style>
	- <form>
	- <img>
	- <onmouseover>
	- <body>
	
etc.

Ok. But if we sent to script:

# <iframe src=http://securityreason?    < Hi

The function don't find wrong tags.
And broswer read this 

"<iframe src=http://securityreason?    < Hi"

and change "<" to ">".
Result:

# <iframe src=http://securityreason?    > Hi

I have checked this in IE, Mozilla, Opera, Links, Lynx etc.
Only don't work in konqueror.

- --- 2. XSS ---

2.0 http://[HOST]/[DIR]/modules.php?name=Search

Insert:

<iframe src=http://securityreason.com?phpnuke79 <

And have you xss.

2.1 http://[HOST]/[DIR]/modules.php?name=Web_Links

Insert:

<iframe src=http://securityreason.com?phpnuke79 <

and more.

- --- 3. How to fix ---

Change xss filter in mainfile.php

- ---
if (!defined('ADMIN_FILE')) {
	foreach ($_GET as $sec_key => $secvalue) {
		if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
		(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
		(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
		(eregi("\"", $secvalue)) ||
		(eregi("forum_admin", $sec_key)) ||
		(eregi("inside_mod", $sec_key))) {
			die ("<center><img src=images/logo.gif><br><br><b>The html tags you 
attempted to use are not allowed</b><br><br>[ <a 
href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
		}
	}
	
	foreach ($_POST as $secvalue) {
		if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || 
(eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", 
$secvalue))) {
			die ("<center><img src=images/logo.gif><br><br><b>The html tags you 
attempted to use are not allowed</b><br><br>[ <a 
href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
		}
	}
} 
- ---

to

- ---
if (!defined('ADMIN_FILE')) {
	foreach ($_GET as $sec_key => $secvalue) {
	if((eregi("<[^>]*script*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*object*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*iframe*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*applet*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*meta*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*style*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*form*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*img*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*onmouseover *\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*body *\"?[^>]*", $secvalue)) ||
		(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
		(eregi("\"", $secvalue)) ||
		(eregi("forum_admin", $sec_key)) ||
		(eregi("inside_mod", $sec_key))) 
		{
			die ($htmltags);
		}

	}

	foreach ($_POST as $secvalue) {
		if ((eregi("<[^>]*iframe*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*object*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*applet*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*meta*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*form*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*img*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*onmouseover*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]script*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]*body*\"?[^>]*", $secvalue)) ||
		(eregi("<[^>]style*\"?[^>]*", $secvalue))) 
		{
			die ($htmltags);
		}
	}
}
- ---

thx nukefixes.com


- --- 4. Greets ---

sp3x, nukefixes.com

- --- 5.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG-KEY: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
SecurityReason.Com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)

iD8DBQFDoE/43Ke13X/fTO4RAtjVAJ0QAELuFkDZqPkKInQvYAw6N7GGRgCfcO+9
lDFOXpKshVbRdsz35LTePSI=
=RFoz
-----END PGP SIGNATURE-----