full-disclosure - Magnolia CMS multiple access control vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CA+s8jv=UNLrhi6_p8Qav6MBP3Bqz9LZajeu1mFygiBXy_wbZrw@mail.gmail.com>
Date: Tue, 25 Jun 2013 18:33:39 +0300
From: Adrian Furtuna <adif2k8@...il.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: Magnolia CMS multiple access control
	vulnerabilities

Subject:
======
Multiple access control vulnerabilities in Magnolia CMS, Community and
Enterprise editions

CVE ID:
=======
CVE-2013-4621

Summary:
========
A non-admin user (such as default users eric / peter) can access and
execute multiple administrative functionalities of the CMS by accessing
directly the specific URLs.

Product:
========
Magnolia CMS

Vendor:
=======
Magnolia International Ltd.

Affected versions:
==================
Magnolia CMS <= 4.5.8
Tested on: 4.5.8, 4.5.7 and 4.5.3, both Community and Enterprise editions

Not-affected version:
=====================
Magnolia CMS 4.5.9

Product information:
====================
Magnolia CMS is an open-source Web Content Management System that focuses
on providing an intuitive user experience in an enterprise-scale system.

Vulnerability details:
======================
The following functionalities can be accessed and executed by a non-admin
user based on the URL:

- View and set the log level of Magnolia
    http://127.0.0.1:8080/magnoliaPublic/.magnolia/log4j

- Read Magnolia log files (can contain sensitive information)

http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/logViewer.html?command=displayFileContent&fileName=magnolia-error.log

http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/logViewer.html?command=displayFileContent&fileName=magnolia-debug.log

- View Magnolia configuration:
    http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/configuration.html

- View permissions of Magnolia users. Also can be used for user enumeration
    http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/permission.html

- Send arbitrary email messages
    http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/sendMail.html

- View the list of installed modules

http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/installedModulesList.html

- Execute arbitrary queries in the repository (limited by the current
user's rights)
    http://127.0.0.1:8080/magnoliaPublic/.magnolia/pages/jcrUtils.html


Vendor contact log:
===================
2013-04-25: Contacting vendor through support@...nolia-cms.com
2013-04-29: Vendor acknowledges the receipt of the advisory
2013-04-29: Vendor confirms the vulnerability
2013-06-03: Vendor releases version 4.5.9 which fixes the vulnerability


Credits:
========
This vulnerability was discovered by Adrian Furtuna
http://pentest-tools.com

Solution:
=========
Upgrade to the latest version of Magnolia CMS

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/