Advisory 11/2005: Multiple vulnerabilities in Contrexx

[Christopher Kunz <christopher.kunz () hardened-php net>]

                        Hardened PHP Project
                        www.hardened-php.net


                      -= Security  Advisory =-


     Advisory: Multiple vulnerabilities in Contrexx
 Release Date: 2005/07/21
Last Modified: 2005/07/18
       Author: Christopher Kunz <christopher.kunz () hardened-php net>
  Application: Contrexx < 1.0.5
     Severity: Cross-Site Scripting, SQL injection and information
               disclosure, password hash disclosure
         Risk: High
Vendor Status: Vendor has released an updated version
   References: http://www.hardened-php.net/advisory_112005.59.html
               (also includes a GnuPG signature for this advisory)


Overview:

   Contrexx is a commercial content management system that has been released as
   an open source product lately. It features typical CMS features like content
   pages, polls, news, RSS feed aggregation and newsletters, split up in modu-
   les.
   The search and the blog aggregation module are vulnerable to Cross-Site
   Scripting, allowing malicious users to hijack user or admin sessions. Unfil-
   tered user input in the poll module allows for MySQL version disclosure, and
   might faciliate further SQL injection attacks under MySQL 5 with subselects.
   SQL Injection in the gallery module can be used to select arbitrary data,
   including a complete list of username/password hash combinations.
   A bundled XML file discloses the Contrexx version in use.


Details:

   1) SQL injection in poll module
   The poll module in Contrexx is made up like any other web-based poll: users
   can vote for one of several choices by clicking a radio button and submitt-
   ing the poll form. The value of the radio button is an integer value that
   is passed to the SQL abstraction layer without any checks or casts:

   $query="SELECT voting_system_id from ".DBPREFIX."voting_results WHERE
        id=".$_POST["votingoption"]." ";
   $db->query($query);

   By saving, changing and submitting a modified poll form to the server, an
   attacker can get the MySQL server to disclose its version.
   On top of that, the results of aforementioned query are fed directly into an
   UPDATE statement that thus can be modified by changing the WHERE clause.
   This can be used to spike polls and may be used for other injection with
   MySQL5's subselects. With magic_quotes_gpc=Off, more evil can be done.
   This is faciliated by the ridiculous input filtering that basically checks
   for SELECT, UPDATE, AND and OR, but leaves /**/SELECT, UPDATE/**/, &&, ||
   untouched.

   2) SQL injection in gallery module
   The pId parameter in Contrexx's gallery module is passed to the database
   layer completely unfiltered:

   if(isset($_GET['pId']) && !empty($_GET['pId'])){
      $this->showPicture($_GET['pId']);
   }
   and in method showPicture():
   $objDb->query("SELECT id,name,path,linkname,link,size_show
                  FROM ".DBPREFIX."module_gallery_pictures
                  WHERE id=".$pictureId);

   An attacker can append arbitrary SQL to the pId parameter, including UNION
   SELECT. However, since there is some - err - "filtering" going on, keywords
   like SELECT, UNION, AND or similar need to be pre- or postfixed with an
   empty SQL comment.
   Using this injection, it is very easy to obtain a full list of usernames and
   password hashes which can then be cracked with a premade MD5 rainbow table.

   3) XSS in the search form
   Plain and simple XSS, exploitable via GET and POST on the front-end search
   form. See below for PoC, it's very straightforward. The input sanitation
   functions seem to differ between Contrexx versions - it was possible to
   inject script code without any additional characters on the Contrexx web
   site (http://www.contrexx.com/).
   Contrexx' input filters filter out "<script>", but, for some unknown reason,
   do not touch "<scr\ipt>".

   4) XSS in blog aggregation module
   Blog aggregation is used to create a "blog roll" for daily perusal by admin-
   istrators or normal web site users. A malicious person could use their leet
   social engineering skills to persuade a Contrexx administrator that their
   blog is worth a daily read - prompting said admin to include this blog in
   their Contrexx blog aggregation.
   Then, the attacker could embed script code in one of their blog entries.
   Since no input filtering is done on incoming RSS aggregations, this script
   code is displayed in the front-end aggregation module and also in the admin
   backend (if the administrator clicks on "preview"). With the resulting XSS
   an attacker could steal the admin's cookies and hijack their session.

   5) Version information disclosure
   In a default installation of Contrexx, a file named "config/version.xml" is
   created upon installation. It contains the exact version information for the
   Contrexx installation.


Proof of Concept:

   1) Modify one of the poll "votingoption" parameters to read like this:
        value="1 /*!50030%20s*/"
      and submit the form. Repeat until no SQL error is displayed - you have
      found the MySQL version running on the server.
      More SQL injection:
        value="123 UNION/**/ SELECT/**/ '1 OR 1=1'"

   2) /index.php?section=gallery&cmd=showCat&cid=41&pId=1%20/**/UNION/**/%20
      /**/SELECT/**/%201,1,CONCAT(username,'-',password),1,1,1%20/**/FROM%20
      contrexx_access_users

   3) /index.php?section=search&term=%22%3E%3Cscr\ipt%3Ealert(%22xss%22)
       %3C/sc\ript%3E

   4) Create a blog entry with the title <script>alert('xss')</script>. Have
      this blog aggregated by Contrexx. Stir. Enjoy.

   5) See /config/version.xml in your Contrexx installation.


Disclosure Timeline:

   08. July 2005 - Vendor informed.
   10. July 2005 - One more bug disclosed to vendor, including PoC.
   19. July 2005 - Vendor has released updated version.
   22. July 2005 - Public disclosure.


Recommendation:

   We strongly recommend installing the updated version, 1.0.5, which is avail-
   able from the vendor's homepage, www.contrexx.com.


Plug:

   You can discuss this and other vulnerabilities in our forum at
   http://forum.hardened-php.net/ - an up-to-date list of advisories can be
   found at http://www.hardened-php.net/.


GPG-Key:

   http://www.hardened-php.net/hardened-php-signature-key.asc

   pub  1024D/0A864AA1 2004-04-17 Hardened-PHP Signature Key
   Key fingerprint = 066F A6D0 E57E 9936 9082  7E52 4439 14CC 0A86 4AA1


Copyright 2005 Christopher Kunz / Hardened PHP Project. All rights reserved.