Advisory 11/2005: Multiple vulnerabilities in Contrexx
Hardened PHP Project
www.hardened-php.net
-= Security Advisory =-
Advisory: Multiple vulnerabilities in Contrexx
Release Date: 2005/07/21
Last Modified: 2005/07/18
Author: Christopher Kunz <christopher.kunz@xxxxxxxxxxxxxxxx>
Application: Contrexx < 1.0.5
Severity: Cross-Site Scripting, SQL injection and information
disclosure, password hash disclosure
Risk: High
Vendor Status: Vendor has released an updated version
References: http://www.hardened-php.net/advisory_112005.59.html
(also includes a GnuPG signature for this advisory)
Overview:
Contrexx is a commercial content management system that has been released as
an open source product lately. It features typical CMS features like content
pages, polls, news, RSS feed aggregation and newsletters, split up in modu-
les.
The search and the blog aggregation module are vulnerable to Cross-Site
Scripting, allowing malicious users to hijack user or admin sessions. Unfil-
tered user input in the poll module allows for MySQL version disclosure, and
might faciliate further SQL injection attacks under MySQL 5 with subselects.
SQL Injection in the gallery module can be used to select arbitrary data,
including a complete list of username/password hash combinations.
A bundled XML file discloses the Contrexx version in use.
Details:
1) SQL injection in poll module
The poll module in Contrexx is made up like any other web-based poll: users
can vote for one of several choices by clicking a radio button and submitt-
ing the poll form. The value of the radio button is an integer value that
is passed to the SQL abstraction layer without any checks or casts:
$query="SELECT voting_system_id from ".DBPREFIX."voting_results WHERE
id=".$_POST["votingoption"]." ";
$db->query($query);
By saving, changing and submitting a modified poll form to the server, an
attacker can get the MySQL server to disclose its version.
On top of that, the results of aforementioned query are fed directly into an
UPDATE statement that thus can be modified by changing the WHERE clause.
This can be used to spike polls and may be used for other injection with
MySQL5's subselects. With magic_quotes_gpc=Off, more evil can be done.
This is faciliated by the ridiculous input filtering that basically checks
for SELECT, UPDATE, AND and OR, but leaves /**/SELECT, UPDATE/**/, &&, ||
untouched.
2) SQL injection in gallery module
The pId parameter in Contrexx's gallery module is passed to the database
layer completely unfiltered:
if(isset($_GET['pId']) && !empty($_GET['pId'])){
$this->showPicture($_GET['pId']);
}
and in method showPicture():
$objDb->query("SELECT id,name,path,linkname,link,size_show
FROM ".DBPREFIX."module_gallery_pictures
WHERE id=".$pictureId);
An attacker can append arbitrary SQL to the pId parameter, including UNION
SELECT. However, since there is some - err - "filtering" going on, keywords
like SELECT, UNION, AND or similar need to be pre- or postfixed with an
empty SQL comment.
Using this injection, it is very easy to obtain a full list of usernames and
password hashes which can then be cracked with a premade MD5 rainbow table.
3) XSS in the search form
Plain and simple XSS, exploitable via GET and POST on the front-end search
form. See below for PoC, it's very straightforward. The input sanitation
functions seem to differ between Contrexx versions - it was possible to
inject script code without any additional characters on the Contrexx web
site (http://www.contrexx.com/).
Contrexx' input filters filter out "<script>", but, for some unknown reason,
do not touch "<scr\ipt>".
4) XSS in blog aggregation module
Blog aggregation is used to create a "blog roll" for daily perusal by admin-
istrators or normal web site users. A malicious person could use their leet
social engineering skills to persuade a Contrexx administrator that their
blog is worth a daily read - prompting said admin to include this blog in
their Contrexx blog aggregation.
Then, the attacker could embed script code in one of their blog entries.
Since no input filtering is done on incoming RSS aggregations, this script
code is displayed in the front-end aggregation module and also in the admin
backend (if the administrator clicks on "preview"). With the resulting XSS
an attacker could steal the admin's cookies and hijack their session.
5) Version information disclosure
In a default installation of Contrexx, a file named "config/version.xml" is
created upon installation. It contains the exact version information for the
Contrexx installation.
Proof of Concept:
1) Modify one of the poll "votingoption" parameters to read like this:
value="1 /*!50030%20s*/"
and submit the form. Repeat until no SQL error is displayed - you have
found the MySQL version running on the server.
More SQL injection:
value="123 UNION/**/ SELECT/**/ '1 OR 1=1'"
2) /index.php?section=gallery&cmd=showCat&cid=41&pId=1%20/**/UNION/**/%20
/**/SELECT/**/%201,1,CONCAT(username,'-',password),1,1,1%20/**/FROM%20
contrexx_access_users
3) /index.php?section=search&term=%22%3E%3Cscr\ipt%3Ealert(%22xss%22)
%3C/sc\ript%3E
4) Create a blog entry with the title <script>alert('xss')</script>. Have
this blog aggregated by Contrexx. Stir. Enjoy.
5) See /config/version.xml in your Contrexx installation.
Disclosure Timeline:
08. July 2005 - Vendor informed.
10. July 2005 - One more bug disclosed to vendor, including PoC.
19. July 2005 - Vendor has released updated version.
22. July 2005 - Public disclosure.
Recommendation:
We strongly recommend installing the updated version, 1.0.5, which is avail-
able from the vendor's homepage, www.contrexx.com.
Plug:
You can discuss this and other vulnerabilities in our forum at
http://forum.hardened-php.net/ - an up-to-date list of advisories can be
found at http://www.hardened-php.net/.
GPG-Key:
http://www.hardened-php.net/hardened-php-signature-key.asc
pub 1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key
Key fingerprint = 066F A6D0 E57E 9936 9082 7E52 4439 14CC 0A86 4AA1
Copyright 2005 Christopher Kunz / Hardened PHP Project. All rights reserved.