full-disclosure - Kevin Johnson BASE <= 1.3.6 authentication bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 4 Jun 2007 22:35:40 +0300
From: "Johnny Storm" <johnny653@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Kevin Johnson BASE <= 1.3.6 authentication bypass

Basic Analysis and Security Engine (BASE)
(http://base.secureideas.net/)

One more security product with lame bugs...

Let's look at Kevin's authentication code,
for example in base_main.php (all pages vulnerable):

 [...]
 64   // Check role out and redirect if needed -- Kevin
  65   $roleneeded = 10000;
  66   $BUser = new BaseUser();
  67   //if (($Use_Auth_System == 1) && ($BUser->hasRole($roleneeded) == 0))
 68   if ($Use_Auth_System == 1)
 69   {
  70       if ($BUser->hasRole($roleneeded) == 0)
 71       {
  72           header("Location: $BASE_urlpath/index.php");
 73       }
 74   }
 [...]

Where is bug?
Yes, your browser will redirect after received location header,
but what if not? ;-)

Test with curl. This is not first authentication issue in BASE,
putting at risk users which use BASE authentication feature.
Google shows up many installations protected by this feature.

All BASE versions with authentication are vulnerable.
ACID is not vulnerable, since it doesn't has such feature.
BASE+ fork has fixed this issue year ago.

Use your web server authentication or BASE+, which sucks less.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/