<<< Date Index >>>     <<< Thread Index >>>

PunBB 1.2.11 Cross site scripting



/*
---------------------------------------------------------------
[N]eo [S]ecurity [T]eam [NST]® Advisory #22
---------------------------------------------------------------
Program : PunBB 1.2.11
Homepage: http://www.punbb.org
Vulnerable Versions: PunBB 1.2.11 & lower ones
Risk: Low!
Impact: Indirect cross site scripting

-> PunBB 1.2.11 Cross site scripting <-
---------------------------------------------------------------

- Description
---------------------------------------------------------------
In short, PunBB is a fast and lightweight PHP powered discussion board. 
It is released under the GNU Public License. Its primary goal is to be 
a faster, smaller and less graphic alternative to otherwise excellent 
discussion boards such as phpBB, Invision Power Board or vBulletin. 
PunBB has fewer features than many other discussion boards, but is 
generally faster and outputs smaller pages.

- Tested
---------------------------------------------------------------
Tested in localhost & many forums

- Bug
---------------------------------------------------------------
In this case the XSS it is taken as a low risk bug because of its 
circumstances.

An admin in PunBB can use a feature called `Admin note' to keep some 
notes about a certain user. The problem is that this note it is not 
sanitized.

As you can see, an attack could only been executed if the admin writes 
a malicius script, wich is stupid.
This note it is seen on every post of the user, but here its filtered, 
the problem lies when the admin look to all users who have a certain IP.
f.e: The admin wants to know all users that have the IP-> 2.0.0.6
The output will be:

Username  E-mail  Title/Status  Posts  Admin note  Actions
baduser   b@xxx   New member     500   [blank]      .....

So, there the admin note its executed as HTML code (JScript) or whatever.

- Exploit
---------------------------------------------------------------
NST will not release any code to exploit this bug.

- Solutions
---------------------------------------------------------------
A new version of PunBB it is available, it is recommended to update it.

- Timeline
---------------------------------------------------------------
26/03/2006 - Vendor was contacted
Many days  - Discussing about the issue explotation.
05/20/2006 - Vendor released a new patched version.

- Discalimer
---------------------------------------------------------------
YOU are the only RESPONSALBE of any DAMAGE of above techniques 
could cause or any code you have made based in this advisory, 
all ideas, proof of concepts, solutions, descriptions were made 
only for EDUCATIONAL propuses, use all above information at your 
own risk.

- References
---------------------------------------------------------------
http://NeoSecurityTeam.net/index.php?action=advisories&id=22
http://www.neosecurityteam.net/advisories/Advisory-22.txt

- Credits
--------------------------------------------------------------
Discovered by k4p0 -> k4p0k4p0[at]hotmail[dot]com

[N]eo [S]ecurity [T]eam [NST]® - http://NeoSecurityTeam.net/

Irc.FullNnetwork.org #nst
Questions? (Eng & Spa) -> http://NeoSecurityTeam.net/foro/

- Greets
---------------------------------------------------------------
Paisterist 
HaCkZaTaN 
Link 
Daemon21 
erg0t
NST Comunity!

@@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
'@@@@@''@@'@@@''''''''@@''@@@''@@
'@@'@@@@@@''@@@@@@@@@'''''@@@''''
'@@'''@@@@'''''''''@@@''''@@@''''
@@@@''''@@'@@@@@@@@@@''''@@@@@'''
*/