Typo <= 5.1.3 Multiple Vulnerabilities
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Typo <= 5.1.3 Multiple Vulnerabilities
- From: L4teral <l4teral@xxxxxxxxx>
- Date: Fri, 31 Oct 2008 19:21:35 +0100
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type:content-transfer-encoding :content-disposition; bh=bY+QhvkzaqnBowwmv/f3OeXfAlHZYwn933KyyvoLtB4=; b=GxOFfx+diWQGgqrtwj5NUc9zb0+Q9zqgIvjBXyT/nI/hRMZAGETBLCVkay3CMBAu8M 6t1cXA4R2JaUh/GnLXKFGOw4EVidQ0llKLdhWZfRCzGHBM+0jbYeAh0EcfXpxQTupjP7 kPMSNmjzG3Oy+Vyb1kfg+vLiRuPz+GzUojSt4=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type :content-transfer-encoding:content-disposition; b=SiTJrxjrjuQQEUxyS4johLHmZI0l/qwkvSUwo5fd4zShzdhwEKdb+DvEi8xddFTjVP Kp9AshKH07DLthVQ3lMz2GMKDpRuJ+cm6cF8/+vWUbZHF0LOlx3W2BvBQzw8cU0B2Q1p n7VwMeZYHSZeyMLsxh3dDAfN3KPoUTiSeVHzo=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
======================================================================
Typo <= 5.1.3 Multiple Vulnerabilities
======================================================================
Author: L4teral <l4teral [at] gmail com>
Impact: Cross Site Scripting
SQL Injection
Insecure password hash salt
Status: patch not available
------------------------------
Affected software description:
------------------------------
Application: Typo
Version: <= 5.1.3
Vendor: http://typosphere.org
Description:
Typo is a blogging engine developped with the Ruby on Rails framework.
--------------
Vulnerability:
--------------
1. The feedback system is vulnerable to cross site scripting.
Script code can be embedded into the "Name" and "Website" fields
when posting a new comment. If the comments are viewed in the admin
panel, the code gets executed in the context of the admin user.
The code embedded in the website paramter also gets executed when
viewing the blog post as normal user.
2. The "Manage pages" part of the administration panel is prone to
SQL injection. The parameter "published_at" is not properly
sanitized due to an erroneous regular expression.
"Blog publisher" rights are needed to exploit this issue.
3. The application uses a salt when storing the password hashes, but
the salt is set to a hardcoded value making the salt less efficient
as equal passwords result in the same hash value.
---------
Timeline:
---------
2008-09-29 - vendor informed
2008-10-02 - vendor informed
2008-10-30 - no response from vendor, public disclosure