full-disclosure - Re: Vulnerability in CB Captcha for Joomla and Mambo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <n2lf5dc671004151720ge41b2c89o54613380bf69fca9@mail.gmail.com>
Date: Fri, 16 Apr 2010 01:20:05 +0100
From: Benji <me@...ji.com>
To: MustLive <mustlive@...security.com.ua>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Vulnerability in CB Captcha for Joomla and
	Mambo

By this point, if these advisories arent automated, you're doing it wrong.

On Thu, Apr 15, 2010 at 12:24 PM, MustLive <mustlive@...security.com.ua>wrote:

> Hello Full-Disclosure!
>
> I want to warn you about security vulnerability in plugin CB Captcha
> (plug_cbcaptcha) for component Community Builder (com_comprofiler) for
> Joomla and Mambo. The posting of this advisory to mailing lists was
> delayed,
> because I found that there are two different vulnerable versions of plugin
> developed by different authors, so I needed to inform all authors.
>
> -----------------------------
> Advisory: Vulnerability in CB Captcha for Joomla and Mambo
> -----------------------------
> URL: http://websecurity.com.ua/4087/
> -----------------------------
> Affected products: CB Captcha 1.0.2 and previous versions (developed by
> Kotofeich), CB Captcha 2.2 and previous versions (developed by Beat).
> -----------------------------
> Timeline:
> 17.03.2010 - found vulnerability.
> 31.03.2010 - disclosed at my site.
> 01.04.2010 - informed developer of CB Captcha 1.x. And because I found
> other
> version of the plugin by another author, and after checking it later I
> informed author of CB Captcha 2.x.
> 13.04.2010 - additionally informed developers of Community Builder (both
> joomlapolis.com and communitybuilder.ru).
> -----------------------------
> Details:
>
> This is Insufficient Anti-automation vulnerability.
>
> This plugin is based on captcha script CaptchaSecurityImages.php and I
> already reported about vulnerabilities in CaptchaSecurityImages
> (http://websecurity.com.ua/4043/). And in plugin plug_cbcaptcha were fixed
> all Insufficient Anti-automation and Denial of Service vulnerabilities from
> original script, except one.
>
> Insufficient Anti-automation:
>
> In the plugin it's possible to bypass captcha with using of session reusing
> with constant captcha bypass method (http://websecurity.com.ua/1551/),
> which
> was described in project Month of Bugs in Captchas. With using of this
> method it's possible to bypass protection by sending the same code of
> captcha.
>
> It can be done at all pages where this plugin is used. In CB Captcha 1.x
> it's using at registration page, lost password form and lost email form. In
> CB Captcha 2.x, in addition to before-mentioned forms, it's using at
> contact
> form (in the presence of component CB Contact 1.1) and login form (in the
> presence of login module of CB 1.2).
>
> PoC:
>
> The PoC for this Insufficient Anti-automation vulnerability was provided to
> developers. Everyone who want can create such PoC from exploit provided in
> above-mentioned article from MoBiC project.
>
> Best wishes & regards,
> MustLive
> Administrator of Websecurity web site
> http://websecurity.com.ua
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/