IndonesiaHack Advisory HTML injection in PHP Fusebox

[king_purba@yahoo.co.uk]

IndonesiaHack Advisory HTML injection in PHP Fusebox

Author : Ph03n1X
Email : king_purba@yahoo.co.uk

Software Description
Name : PHP Fusebox 4.0.6
Vendor : http://prdownloads.sourceforge.net/php-fusebox/FB3_PHP_b6.zip?download

PoC :

http://site.xxx/fusebox/index.php?fuseaction=<h1><marquee>Halo</marquee></h1>

Vulnerable Code in file fbx_Fusebox3.0_PHP4.0.6.php :

$FB_["rawFA"] = ($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}


Fix:

$FB_["rawFA"] = htmlspecialchars($attributes["fuseaction"]);
if(ListLen($FB_["rawFA"], ".") == 1 && substr($FB_["rawFA"], -1) == ".") {
$Fusebox["fuseaction"] = "Fusebox.defaultFuseaction";
}


Credit :

Zhainal, No-p****le (Bole disebut gak namanya om), All crew IndonesiaHack @ dalnet
Nanang SW, nighlogin

[brian428@yahoo.com]

This isn't a vulnerability. The framework is doing what it is supposed to, and it isn't the job of the framework to place arbitrary restrictions on what the user can pass into it. For example, the CF version of Fusebox has also had this "vulnerability" po
inted out. But CF already has a mechanism to eliminate XSS attacks through the use of the "scriptProtect" attribute of the cfapplication tag. So if the core file were to incorporate some sort of XSS scrubbing, it would have to be disabled by default so as
not to duplicate what the web application server is already doing. Which would mean the developer would have to turn it on. Which would mean that the developer already was aware of the danger of XSS and the need to prevent it. Which would make the additi
on of framework-based scrubbing moot. The framework is there to ease development, not stop the developer from making every kind of mistake.

[pr1nce_empire@yahoo.com]

I don't think so, this is a vulneralability since the "scriptProtect" isn't applied to this variable
$FB_["rawFA"] = $attributes["fuseaction"];

simple example :
I have "scriptProtect" like this :

function validate($char)
{
if(preg_match('/[\'\"%|*(){}~`!@#$;\\/=+-_^]/',$char))
die("We have received an error request\n<br>");
}

Then the URL "http://xxx.xx/test.php?msg=blablabla"

test.php like the following script is vulner because validate function isn't applied.
<?php
$test=$_GET[msg];
echo "$test";
?>

We can solve the problem by validating GET request like this :
$test=validate($_GET[msg]);

I think that this case is clear enough.

Cheers