full-disclosure - multiple CAPTCHA automation test bypass digest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 3 Jan 2008 22:53:27 +0300
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: bugtraq <bugtraq@...urityfocus.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: multiple CAPTCHA automation test bypass digest

Dear bugtraq,

  Below  is a digest of vulnerabilities in multiple CAPTCHA systems. All
  vulnerabilities  were reported by MustLive (websecurity.com.ua) during
  "The Month of Bugs in CAPTCHA"

1. Peter▓s Custom Anti-Spam Image < 2.9 (Wordpress plugin)

   1.1 "antiselect" value can be guessed with 10% probability.
   1.2 Same check pairs may be used for multiple postings

   According  to vendor both problems were addressed in Version 2.9.0 on
   August 11, 2007

   Original article: http://websecurity.com.ua/1501/
   Exploit for 1.2: http://websecurity.com.ua/uploads/2007/MoBiC/Peter's%20Custom%20Anti-Spam%20Image%20CAPTCHA%20bypass.html

2. mt-scode CAPTCHA (plugin for Movable type and Drupal)

   Same check pairs may be used for multiple postings

   Original article: http://websecurity.com.ua/1516/
   Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/mt-scode%20CAPTCHA%20bypass.html

3. PHP-Nuke <= 8.1

   3.1 Same check pairs may be used for multiple postings/registrations

   Original article: http://websecurity.com.ua/1527/
   Exploit:
           http://websecurity.com.ua/uploads/2007/MoBiC/PHP-Nuke%20CAPTCHA%20bypass.html
           (posting)
           http://websecurity.com.ua/uploads/2007/MoBiC/PHP-Nuke%20CAPTCHA%20bypass2.html
           (registration)

   3.2  NULL  string  CAPTCH bypass: if NULL string is given, CAPTCHA is
   not validated.

   Original article: http://websecurity.com.ua/1528/
   Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/PHP-Nuke%20CAPTCHA%20bypass3.html

4. Peter▓s Random Anti-Spam Image <= 0.2.4 (Wordpress plugin)

   CAPTCHA may be bypassed by pre-generating possible image-code pairs.

   Original article: http://websecurity.com.ua/1534/
   Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/Peter's%20Random%20Anti-Spam%20Image%20CAPTCHA%20bypass.html

5. Cryptographp <= 1.12 (Wordpress plugin)

   It's possible to reuse same security code during session

   Originale article: http://websecurity.com.ua/1551/
   Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/Cryptographp%20CAPTCHA%20bypass.html

6. PHP-Fusion / HBH-Fusion (version not reported) CAPTCHA bypass

   It's possible to reuse same security code during session

   Original article:
            http://websecurity.com.ua/1558/ (PHP-Fusion)
            http://websecurity.com.ua/1561/ (HBH-Fusion)
   Exploit:
            http://websecurity.com.ua/uploads/2007/MoBiC/PHP-Fusion%20CAPTCHA%20bypass.html
            (PHP-Fusion)
            http://websecurity.com.ua/uploads/2007/MoBiC/HBH-Fusion%20CAPTCHA%20bypass.txt
            (HBH-Fusion)
            
7. Nucleus  <= 3.01 CAPTCHA bypass

   7.1 CAPTCHA may be bypassed by pre-generating possible image-code pairs.
   7.2 SQL injection vulnerability can be used to bypass CAPTCHA
   

   Original article:
            (7.1) http://websecurity.com.ua/1564/
            (7.2) http://websecurity.com.ua/1565/
   Exploit:
            (7.1) http://websecurity.com.ua/uploads/2007/MoBiC/Nucleus%20CAPTCHA%20bypass.html
            (7.2) http://websecurity.com.ua/uploads/2007/MoBiC/Nucleus%20CAPTCHA%20bypass2.html

8. Auto-Input Protection (AIP) <= 2.0 (for ASP.Net)

   Same check pairs may be used for multiple postings

   Original article:   http://websecurity.com.ua/1568/
   Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/AIP%20CAPTCHA%20bypass.html
   Vendor's suggested workaround:
   http://davesexton.com/blog/blogs/blog/archive/2007/12/12/aip-1-0-0-bypassed.aspx

9. Math Comment Spam Protection  <= 2.1 (Wordpress plugin)

   Same check pairs may be used for multiple postings

   Original article: http://websecurity.com.ua/1575/
   Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/Math%20Comment%20Spam%20Protection%20CAPTCHA%20bypass.html

10. Anti Spam Image <= 0.5 (Wordpress plugin)

   It's possible to reuse same security code during session

   Original article: http://websecurity.com.ua/1584/
   Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/Anti%20Spam%20Image%20CAPTCHA%20bypass.html

11. Captcha! <= 2.5d (Wordpress plugin)

    It's  possible  to  bypass  CAPTCHA  by  combining  crossite request
    forgery vulnerability with NULL string for security code.

    Original article: http://websecurity.com.ua/1587/
    Exploit:
            http://websecurity.com.ua/uploads/2007/MoBiC/Captcha!%20CSRF.html
            (crossite request forgery)
            http://websecurity.com.ua/uploads/2007/MoBiC/Captcha!%20CAPTCHA%20bypass.html
            (CAPTCHA bypass)
    
12. WP-ContactForm <= 2.0.7 (Wordpress plugin)

    Same security code may be used for multiple times

    Original article: http://websecurity.com.ua/1599/
    Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/WP-ContactForm%20CAPTCHA%20bypass.html

13. Drupal (reCaptcha)

    unique  captcha_token parameter without recaptcha_response_field may
    be used to bypass CAPTCHA.

    Vulnerability  is  reported  in  reCaptcha  plugin  for  Drupal, but
    according to reCaptcha developers, vulnerability is in Drupal code.

    Original article: http://websecurity.com.ua/1505/
    Exploit: http://websecurity.com.ua/uploads/2007/MoBiC/reCaptcha.txt

    
    
   
-- 
http://securityvulns.com/
         /\_/\
        { , . }     |\
+--oQQo->{ ^ }<-----+ \
|  ZARAZA  U  3APA3A   } You know my name - look up my number (The Beatles)
+-------------o66o--+ /
                    |/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/