full-disclosure - BF, CSRF, AoF and IAA vulnerabilities in MODx Revolution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <00c601cde47c$8f6b6470$9b7a6fd5@pc>
Date: Thu, 27 Dec 2012 23:52:41 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: BF, CSRF,
	AoF and IAA vulnerabilities in MODx Revolution

Hello list!

I want to warn you about multiple vulnerabilities in MODx Revolution.

These are Brute Force, Cross-Site Request Forgery, Abuse of Functionality 
and Insufficient Anti-automation vulnerabilities in MODx. It's about 2.x 
(Revolution) versions of MODx. In 0.x and 1.x (Evolution) versions of MODx 
CMS there are much more holes, about which I've wrote earlier. Developers 
changed the code of their CMS in 2.x versions, which decreased number of 
vulnerabilities (like DoS hole, but Login Enumeration hole just changed into 
different one). As I've found at tested web site - one Ukrainian government 
site, also there were multiple XSS holes on it (which are still not fixed), 
which were not related to core of engine, it was custom code.

-------------------------
Affected products:
-------------------------

Vulnerable are all versions of MODX Revolution (2.x versions of engine).

----------
Details:
----------

Brute Force (WASC-11):

In login form (http://site/manager/) there is no protection from Brute Force 
attacks.

Cross-Site Request Forgery (WASC-09):

Lack of captcha in login form (http://site/manager/) can be used for 
different attacks - for CSRF-attack to login into account (remote login - to 
conduct attacks on vulnerabilities inside of account), for automated 
entering into account, for phishing and other automated attacks. Which you 
can read about in the article "Attacks on unprotected login forms" 
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html).

Abuse of Functionality (Login Enumeration) (WASC-42):

In login form (http://site/manager/) Login Enumeration is possible. 
Different messages are shown for correct and incorrect logins.

Insufficient Anti-automation (WASC-21):

In login form there is no protection against automated request, which allow 
to picking up logins in automated way by attacking on login function and by 
attacking on password recovery function it's possible to reveal users' 
emails. Both functionals are placed at the same page.

------------
Timeline:
------------ 

2012.06.28 - announced at my site about MODx Evolution.
2012.06.28 - informed developers about the first part of vulnerabilities in 
MODx Evolution.
2012.06.30 - informed developers about the second part of vulnerabilities in 
MODx Evolution.
2012.07.26 - announced at my site about MODx Revolution.
2012.07.28 - informed developers about vulnerabilities in MODx Revolution 
and reminded about previous two letters.
2012.07.28-2012.10.31 - during conversation with developers about MODx 
Revolution, I was constantly reminding them, that I've sent them info about 
holes in Evolution and I can resent them, because it was clear that they 
missed it (they only were answering concerning Revolution).
2012.11.02 - after developers said they want to see this information (missed 
by them in June), I've resent the first two letters to the developers.
2012.12.27 - disclosed at my site (http://websecurity.com.ua/5981/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/