CS-Cart v4.2.0 Session Hijack and Other Vulnerabilities

[Nik Cubrilovic <nikcub () gmail com>]

Vendor: CS-Cart
Homepage: https://www.cs-cart.com
Fixed in: v4.2.1
Released: July 22nd 2014

CS-Cart is 127MB of shitty PHP and HTML code that is supposed to
function as a secure e-commerce site. It is developed by people who
don't reply to emails but who covertly patch bugs reported to them and
then don't tell anyone about it. For some reason a lot of people run
it, and pay for it, and store customer credit cards in it.

In versions up to v4.2.0 the session ID is nothing more than the md5
hash of uniqid() with time() passed to it. Turns out uniqid() is
itself nothing more than a call to time(), and that makes a horrible
session ID.

Other bugs mean you can trigger session regeneration with a URL,
meaning you can narrow down the brute force search space.

Blog post explainer with exploit etc. here:

https://www.nikcub.com/posts/cs-cart-v4-2-0-session-hijacking-and-other-vulnerabilities/

Vendor changelog with no mention of security:

http://www.cs-cart.com/changelog421.html

see line:

> Sessions: Session ID is now generated with the OpenSSL:openssl_random_pseudo_bytes function.

Both my bug and my suggestion. You're welcome.

Nik

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/