Message-ID: <921fa1f2-4643-4c6f-6682-6006f4801ada@sec-consult.com>
Date: Wed, 28 Feb 2018 12:08:53 +0100
From: SEC Consult Vulnerability Lab <research@...-consult.com>
To: <bugtraq@...urityfocus.com>, <fulldisclosure@...lists.org>
Subject: [FD] SEC Consult SA-20180228-0 :: Insecure Direct Object Reference
 vulnerability in TestLink Open Source Test Management

SEC Consult Vulnerability Lab Security Advisory < 20180228-0 >
=======================================================================
              title: Insecure Direct Object Reference
            product: TestLink Open Source Test Management
 vulnerable version: <1.9.17
      fixed version: 1.9.17 (after November 2017), and the current
                     "testlink_1_9" branch
         CVE number: -
             impact: Medium
           homepage: http://testlink.org/
              found: 2017-09-22
                 by: T. Weber (Office Vienna)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Bangkok - Berlin - Linz - Luxembourg - Montreal
                     Moscow - Munich - Kuala Lumpur - Singapore
                     Vienna (HQ) - Vilnius - Zurich

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"TestLink is a web based test management and test execution system.
It enables quality assurance teams to create and manage their test
cases as well as to organize them into test plans. These test plans
allow team members to execute test cases and track test results
dynamically."

Source: https://github.com/TestLinkOpenSourceTRMS/testlink-code


Business recommendation:
------------------------
SEC Consult advises to immediately install the available updates as attackers
might gain access to sensitive data belonging to other users.

A thorough security review performed by security professionals is highly
recommended in order to identify potential further security deficiencies.


Vulnerability overview/description:
-----------------------------------
1) Insecure Direct Object Reference
An unauthenticated user can gain access to referenced files which are produced by
different test cases. By using a simple ID iterator, all produced output
data can be gathered from the whole system.

The actual impact strongly depends on the classification of the produced data
which is referenced. Therefore, the risk can vary from low to critical
depending on the use case.


Proof of concept:
-----------------
1) Insecure Direct Object Reference
An unauthenticated attacker can download data from the TestLink environment
by using the following url:
http://<IP-Address>/lib/attachments/attachmentdownload.php?skipCheck=1&id=<ID>

The tag <IP-Address> specifies the target address and can also include a sub-
folder where the hosted TestLink application is located.


Vulnerable / tested versions:
-----------------------------
The following versions have been tested and are vulnerable. It is assumed that
older versions are affected as well, e.g.:
* 1.9.16
* 1.9.15
* 1.9.14


Vendor contact timeline:
------------------------
2017-10-18: Contacting vendor through http://mantis.testlink.org
            Vendor requested the information.
2017-10-19: Asked if the advisory should be uploaded to mantis directly.
2017-10-21: Contact agreed.
2017-10-23: Uploaded the advisory to mantis.
2017-11-01: Contact provided a fix for 1.9.16. Fixes will be created for
            1.9.15 and 1.9.14 too. Vendor asked us for verification.
2017-11-07: Stated that verification is not possible at the moment (no test
            instance) and that it can be verified easily with the PoC
2018-01-09: Asked for status update; No answer.
2018-01-29: Asked for status update; No answer.
2018-02-16: Asked for status update.
2018-02-17: Vendor responded that we can re-check the fix or release the
            advisory.
2018-02-19: Asked the vendor for reachable test-instance, reply: there is
            no test instance
2018-02-28: Public release of security advisory


Solution:
---------
Check-out the current testlink-code on branch "testlink_1_9":
https://github.com/TestLinkOpenSourceTRMS/testlink-code/tree/testlink_1_9/

The following commit contains the fix since 2017-11-01:
https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/d5ffdb7634e43ba352e9567333682b6436cfb43d

Upgrade to 1.9.17 (after November 2017).


Workaround:
-----------
Restrict network access and do not expose the TestLink interface to the
internet.


Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Bangkok - Berlin - Linz - Luxembourg - Montreal
Moscow - Munich - Kuala Lumpur - Singapore
Vienna (HQ) - Vilnius - Zurich

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/about-us/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF T.Weber / @2018


Download attachment "smime.p7s" of type "application/pkcs7-signature" (3995 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists