=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
INetCop Security Advisory #2006-0x82-029
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D


* Title: zeroboard IP session bypass XSS vulnerability


0x01. Description


Zeroboard is a popular web notice board used in Korea.

INetCop Security found XSS vulnerability in the latest zeroboard version 4.=
1 pl 7 (2005. 4. 4).
Basically, zeroboard uses the following algorithm so that session may not b=
e abused
by the attack related with cookie. (e.g: cookie spoofing, sniffing)

After login, is part that handle session: --

bbs/login_check.php:
....
24 // =C8=B8=BF=F8=B7=CE=B1=D7=C0=CE=C0=CC =BC=BA=B0=F8=C7=CF=BF=B4=C0=
=BB =B0=E6=BF=EC =BC=BC=BC=C7=C0=BB =BB=FD=BC=BA=C7=CF=B0=ED =C6=E4=C0=CC=
=C1=F6=B8=A6 =C0=CC=B5=BF=C7=D4
25 if($member_data[no]) {
26
27 if($auto_login) {
28 makeZBSessionID($member_data[no]);
29 }
30
31 // 4.0x =BF=EB =BC=BC=BC=C7 =C3=B3=B8=AE
32 $zb_logged_no =3D $member_data[no];
33 $zb_logged_time =3D time();
34 $zb_logged_ip =3D $REMOTE_ADDR; <--- Recording IP a=
ddress
35 $zb_last_connect_check =3D '0';
36
37 session_register("zb_logged_no");
38 session_register("zb_logged_time");
39 session_register("zb_logged_ip");
40 session_register("zb_last_connect_check");
41
--

If IP address is different from present session user's, connection terminat=
es: --

bbs/lib.php:

94 // =BC=BC=BC=C7 =B0=AA=C0=BB =C3=BC=C5=A9=C7=CF=BF=
=A9 =B7=CE=B1=D7=C0=CE=C0=BB =C3=B3=B8=AE
95 } elseif($HTTP_SESSION_VARS["zb_logged_no"]) {
96
97 // =B7=CE=B1=D7=C0=CE =BD=C3=B0=A3=C0=CC =
=C1=F6=C1=A4=B5=C8 =BD=C3=B0=A3=C0=BB =B3=D1=BE=FA=B0=C5=B3=AA =B7=CE=B1=D7=
=C0=CE
=BE=C6=C0=CC=C7=C7=B0=A1 =C7=F6=C0=E7 =BB=E7=BF=EB=C0=DA=C0=C7 =BE=C6=C0=CC=
=C7=C7=BF=CD =B4=D9=B8=A6 =B0=E6=BF=EC =B7=CE=B1=D7=BE=C6=BF=F4 =BD=C3=C5=
=B4
98 if(time()-$HTTP_SESSION_VARS["zb_logged_tim=
e"]>
$_zbDefaultSetup["login_time"]||$HTTP_SESSION_VARS["zb_logged_ip"]!=3D$REMO=
TE_ADDR)
{
99
100 $zb_logged_no=3D""; // session init=
ialization
101 $zb_logged_time=3D"";
102 $zb_logged_ip=3D"";
103 session_register("zb_logged_no");
104 session_register("zb_logged_ip");
105 session_register("zb_logged_time");
106 session_destroy();
107
108 // =C0=AF=C8=BF=C7=D2 =B0=E6=BF=EC =B7=CE=
=B1=D7=C0=CE =BD=C3=B0=A3=C0=BB =B4=D9=BD=C3 =BC=B3=C1=A4
109 } else {
--


This seems to be intercepting cookie hacking.
But, if we take advantage of IP session disablement technique, session bypa=
ssing may be possible.
Detailed explanation about the way to exploit this vulnerability is found a=
t the following reference.

URL: http://x82.inetcop.org/h0me/papers/i...ag_exploit.txt (Korean)

As a result, hacker through administrator's web browser exploit code workab=
ly become.


--


0x02. Vulnerable Packages


Vendor site: http://www.nzeo.com/

Low versions including Zeroboard 4.1 pl 7 (2005. 4. 4) version.
-zb41pl7.tar.Z=20

Disclosure Timeline:
2003-04.??: Vulnerabilities found.
2006-02.17: 1st vendor contact. (didn't respond)
2006-02.22: 2nd vendor contact. (didn't respond)
2006-02.25: Vendor responded, patch released.
2006-03.12: Public disclosure.


0x03. Exploit


We have 2 `Proof-of-Concept' exploit about this vulnerability.

This XSS vulnerability happens in memo box title and user email, homepage i=
nformation input.
When administrator logins and checks a user information page, attack code c=
an be achieved,
and there is another way, which injects an attack code in memo title.
After exploit, an attacker can inject PHP code through an administrator web=
page function.
Through this PHP code injection, the attacker(normal user) can change the p=
assword of
administrator, and take administrator's privilege

To prevent the abuse of this vulnerabilty, INetCop Security will not publis=
h POC code.


0x04. Patch


INetCop Security released temporary patch:
INetCop Security Patch URL: http://inetcop.net/upfiles/Zeroboard-4.1_pl7_pa=
tch.tgz

And vendor's patch after INetCop Security advisory:
Vendor Patch URL: http://www.nzeo.com/bbs/zboard.php?i...bugreport2&no=
=3D5406

--
Thank you.

P.S: I give thanks to Securityproof that suffer translation.
Korean Advisory URL: http://www.inetcop.org/upfiles/33INCSA.2006-0x82-029-z=
eroboard.pdf


--
By "dong-houn yoU" (Xpl017Elz), in INetCop(c) Security.

MSN & E-mail: szoahc(at)hotmail(dot)com,
xploit(at)hackermail(dot)com

INetCop Security Home: http://www.inetcop.org
My World: http://x82.inetcop.org

GPG public key: http://x82.inetcop.org/h0me/pr0file/x82.k3y
--




--=20
_______________________________________________
Get your free email from http://www.hackermail.com