PDA

Bekijk Volledige Versie : Bypass XSS filter in PHPNUKE 7.9=>x


max@jestsuper.pl
14/12/05, 23:15
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[Bypass XSS filter in PHPNUKE 7.9=>x cXIb8O3.21]

Author: Maksymilian Arciemowicz ( cXIb8O3 )
Date: 14.12.2005
from SECURITYREASON.COM

- --- 0.Description ---
PHP-Nuke is a Web Portal System, storytelling software, news system, online community or whatever you want to call it. Its goal is to have an automated web site to distribute news and articles with user system. Each user can submit comments to discuss the
articles, similar to Slashdot and many others. Features: web admin, polls/surveys with comment, statistics, user customizable box, themes manager, friendly admin GUI, moderation system, sections manager, banner system, backend/headlines generation, Yahoo
like search engine, Ephemerids manager, file manager, download manager, faq manager, advanced blocks system, reviews system, newsletter, content management, encyclopedia generator, md5 password encryption, phpBB Forums integration, support for 25 languag
es, 100% modular and more. Written 100% in PHP and requires Apache, PHP and a SQL Database Server. Supports MySQL, PostgreSQL, Adabas, mSQL and many others.

- --- 1. Bypass XSS filter ---

In PHPnuke is (file includes/mainfile.php).

- -168-193---
if (!defined('ADMIN_FILE') && !file_exists('includes/nukesentinel.php')) {
foreach ($_GET as $sec_key => $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*body*\"?[^>]*>", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
die ($htmltags);
}
}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]*body*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
die ($htmltags);
}
}
}
- -168-193---

This functions deletes from input html tags like:

- <script>
- <object>
- <iframe>
- <applet>
- <meta>
- <style>
- <form>
- <img>
- <onmouseover>
- <body>

etc.

Ok. But if we sent to script:

# <iframe src=http://securityreason? < Hi

The function don't find wrong tags.
And broswer read this

"<iframe src=http://securityreason? < Hi"

and change "<" to ">".
Result:

# <iframe src=http://securityreason? > Hi

I have checked this in IE, Mozilla, Opera, Links, Lynx etc.
Only don't work in konqueror.

- --- 2. XSS ---

2.0 http://[HOST]/[DIR]/modules.php?name=Search

Insert:

<iframe src=http://securityreason.com?phpnuke79 <

And have you xss.

2.1 http://[HOST]/[DIR]/modules.php?name=Web_Links

Insert:

<iframe src=http://securityreason.com?phpnuke79 <

and more.

- --- 3. How to fix ---

Change xss filter in mainfile.php

- ---
if (!defined('ADMIN_FILE')) {
foreach ($_GET as $sec_key => $secvalue) {
if ((eregi("<[^>]*script*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*>", $secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key))) {
die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
}
}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*onmouseover*\"?[^>]*>", $secvalue)) || (eregi("<[^>]script*\"?[^>]*>", $secvalue)) || (eregi("<[^>]style*\"?[^>]*>", $secvalue))) {
die ("<center><img src=images/logo.gif><br><br><b>The html tags you attempted to use are not allowed</b><br><br>[ <a href=\"javascript:history.go(-1)\"><b>Go Back</b></a> ]");
}
}
}
- ---

to

- ---
if (!defined('ADMIN_FILE')) {
foreach ($_GET as $sec_key => $secvalue) {
if((eregi("<[^>]*script*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*iframe*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*style*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*onmouseover *\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*body *\"?[^>]*", $secvalue)) ||
(eregi("\([^>]*\"?[^)]*\)", $secvalue)) ||
(eregi("\"", $secvalue)) ||
(eregi("forum_admin", $sec_key)) ||
(eregi("inside_mod", $sec_key)))
{
die ($htmltags);
}

}

foreach ($_POST as $secvalue) {
if ((eregi("<[^>]*iframe*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*object*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*applet*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*meta*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*form*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*img*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*onmouseover*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]script*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]*body*\"?[^>]*", $secvalue)) ||
(eregi("<[^>]style*\"?[^>]*", $secvalue)))
{
die ($htmltags);
}
}
}
- ---

thx nukefixes.com


- --- 4. Greets ---

sp3x, nukefixes.com

- --- 5.Contact ---
Author: Maksymilian Arciemowicz < cXIb8O3 >
Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com
GPG-KEY: http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
SecurityReason.Com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (FreeBSD)

iD8DBQFDoE/43Ke13X/fTO4RAtjVAJ0QAELuFkDZqPkKInQvYAw6N7GGRgCfcO+9
lDFOXpKshVbRdsz35LTePSI=
=RFoz
-----END PGP SIGNATURE-----
Paul Laudanski
18/12/05, 01:00
On 14 Dec 2005 max@jestsuper.pl wrote:

> [Bypass XSS filter in PHPNUKE 7.9=>x cXIb8O3.21]
>
> 2.0 http://[HOST]/[DIR]/modules.php?name=Search
>
> Insert:
>
> <iframe src=http://securityreason.com?phpnuke79 <
>
> And have you xss.
>
> 2.1 http://[HOST]/[DIR]/modules.php?name=Web_Links
>
> Insert:
>
> <iframe src=http://securityreason.com?phpnuke79 <
>
> foreach ($_POST as $secvalue) {
> if ((eregi("<[^>]*iframe*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]*object*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]*applet*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]*meta*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]*form*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]*img*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]*onmouseover*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]script*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]*body*\"?[^>]*", $secvalue)) ||
> (eregi("<[^>]style*\"?[^>]*", $secvalue)))
> {
> die ($htmltags);
> }
> }
>
> thx nukefixes.com
>
>
> - --- 4. Greets ---
>
> sp3x, nukefixes.com
> Author: Maksymilian Arciemowicz < cXIb8O3 >
> Email: max [at] jestsuper [dot] pl or cxib [at] securityreason [dot] com

Thanks for the information but the filtering doesn't make any sense. Any
data that is accepted is to be considered tainted and dealt with
appropriately. This doesn't apply to just Web_Links or Search modules,
but also other modules such as Forums.

If I take your exact example code:

<iframe src=http://securityreason.com?phpnuke79 <

And post it to a forum post in a
block to discuss, I'll be
thrown an exception per your code because it'll be caught by your HTTP
POST filtering.

What you need to do is use htmlentities or htmlspecialchar to sanitize
data before it's displayed to the user. Your "fix" will easily break many
sites that are focused on programming discussions. Its important to know
how to "filter" input properly.

One other problem is you are removing the stock filters from being called
upon if ADMIN_FILE is defined. Problem here is if the admin's account
gets hijacked, there is no code to prevent admin from instantiating a
malformed request or post. XSS, CRSF, you name it...

--
Paul Laudanski, Microsoft MVP Windows-Security
[de] http://de.castlecops.com
[en] http://castlecops.com
[wiki] http://wiki.castlecops.com
[family] http://cuddlesnkisses.com