Full Disclosure mailing list archives
Ph0rum phorum_uriauth replay attack
From: Konstantin Gavrilenko <mlists () arhont com>
Date: Wed, 19 May 2004 16:12:35 +0100
Arhont Ltd.- Information Security Arhont Advisory by: Konstantin Gavrilenko (http://www.arhont.com) Advisory: Ph0rum phorum_uriauth replay attack Class: design bug ? Version: 4.3.7 Model Specific: Other version might have the same bug Contact Date: 11/05/2004 (email sent to tomaz () phorum org) PD* release date: 19/05/2004 DETAILS:It is possible to relogin into the previously not loged out sessions in Ph0rum udner certain conditions. Two criterias have to be fulfilled:
- the member has to leave the phorum without logging out. - you have to intercept the hash of his not logged out session or grep it out of web-seerver logs ~ e.g. the intercepted URL or taken straight out of the apache logs http://xxx.xxx.xxx/phorum/profile.php?f=1&id=2&phorum_uriauth=testuser%3Aeb5cd67f6daf1f35d45a24a36355f4b1post it into mozilla/Opera and you are in. Works both for ph0rum user and admin.
maybe it is worthwile to add an auto-expire function for sessions? Risk Factor: Low/Medium Workarounds: Always log out :) *According to the Arhont Ltd. policy, all of the found vulnerabilities and security issues will be reported to the manufacturer 7 days before releasing them to the public domains (such as CERT and BUGTRAQ). If you would like to get more information about this issue, please do not hesitate to contact Arhont team. -- Respectfully, Konstantin V. Gavrilenko Arhont Ltd - Information Security web: http://www.arhont.com http://www.wi-foo.com e-mail: k.gavrilenko () arhont com tel: +44 (0) 870 44 31337 fax: +44 (0) 117 969 0141 PGP: Key ID - 0x4F3608F7 PGP: Server - keyserver.pgp.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Ph0rum phorum_uriauth replay attack Konstantin Gavrilenko (May 19)