Getsimple CMS 2.01 < 2.02 - Administrative Credentials Disclosure
Researcher: Michael Brooks Affecting: GetSimple CMS 2.01 and 2.02 Fixed:2.03 Vulnerability: Administrative Credentials Disclosure Vendor's Homepage: http://code.google.com/p/get-simple-cms download url for 2.01: http://www.box.net/get-simple/1/30435008/399754548 download svn for 2.02(beta): svn checkout http://get-simple-cms.googlecode.com/svn/trunk/ get-simple-cms-read-only GetSimple does not use a SQL Database. Instead it uses a system of .xml files located here: http://127.0.0.1/GetSimple_2.01/data. These files are used to maintain application state and organize the applications content. The administrators username and password hash can be obtained by navigating to the following xml file: http://127.0.0.1/GetSimple_2.01/data/other/user.xml Passwords are stored using sha1() and a salt is not used by default, although a user can configure the application to use one. It is trivial to break this hash using John The Ripper or Cain and Able . All failed login attempts are put into the following XML file, this information can greatly reduce the number of guesses that an attacker would have to make in order to break the sha1 hash. http://127.0.0.1/GetSimple_2.01/data/other/logs/failedlogins.log There are other interesting files such as a clear text API token can be obtained: http://127.0.0.1/GetSimple_2.01/data/other/authorization.xml The patch is simple, in the ./data/ directory add a .htaccess file with that contains "deny from all". |