aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 22-Sep-2006 Software: Squiz - My Source and My Source Matrix http://www.squiz.net.au "MySource Matrix is the newest version of the popular MySource CMS, purpose built for enterprise level installations. It boasts all the features of high-end systems such as highly configurable workflow, a powerful integrated search engine, intuitive front-end editing, true rollback and much more." Versions affected: MySource Matrix 3.8 and below, MySource 2.x. Vulnerability discovered: MySource Matrix may be used as an unauthorised HTTP proxy (and XSS). Vulnerability impact: Low - An anonymous user may use the MySource based website as a proxy. Additionally, proxied bandwidth may be at great financial expense. Remote content may contain JavaScript which is client executed. Vulnerability information A function of the software 'sq_remote_page_url' allows inclusion of remote content in the body of the website. Example: (wrapped) http://www.mysource-example.com.au/$page?sq_remote_page_action= fetch_url&sq_remote_page_url=http://www.google.com.au ... where '$page' is a valid CMS reference, e.g. 'about_us'. This will return the Google website, encapsulated in the header and footer HTML of the www.mysource-example.com.au site. The remote page may contain JavaScript for XSS purposes, e.g. cookies. Remote PHP inclusion does not appear to be possible (returns % hex value). One could write a script to enable a world wide anonymous proxy array. Solution: The vendor does not consider this a vulnerability. Newer versions of the software include a function 'sq_content_src' to hide the URL (Base64), in addition to use of a string whitelist to permit inclusion, for example: if whitelist = http://www.trust-content.com/index?id=*, where * = <wildcard> ok = http://www.trust-content.com/index?id=1234 bad = http://www.trust-content.com/index?ref=1234 Note that whilst the URL is Base64 encoded, this does not necessarily mean that whitelists are used. Future releases may be proxied via: http://www.mysource-example.com.au/$page? sq_content_src=aHR0cDovL3d3dy5nb29nbGUuY29tLmF1 References: aushack.com advisory http://www.aushack.com/advisories/200607-mysourcematrix.txt Credit: Patrick Webster ( patrick (at) aushack (dot) com [email concealed] ) Disclosure timeline: 27-Apr-2006 - Discovered during audit, Squiz notified shortly after. 07-Jun-2006 - Sent security patch query to Squiz developers. 09-Jun-2006 - Squiz response - use whitelist function. 22-Sep-2006 - Public disclosure. EOF