*) Author: l0om ( http://l0om.org ) *) Date: 10.03.2014 *) Overview: Cosmoshop is installed with a lot of admin scripts which should be only accessible as the logged-in admin. The script "pwd.cgi" is not protected and will create a .htaccess file for the admin-directory with any content. This may lead to phishing-attacks and more. *) affected products Probably all Cosmoshop-Versions > 8.0 *) Details: Cosmoshop is another webshop-solution written in perl developed for the german market. The "pwd.cgi" file creates a .htaccess file to provide .htaccess protection for the whole admin directory. The file is located in the same directory as the login-script. To check if you are vulnerable simply get to the admin-directory as the not logged-in admin and open the "pwd.cgi" file ( e.g. "/cosmoshop/cgi-bin/admin/pwd.cgi"). The user has to supply in a form-element a username and a password. The script will automaticly create .htaccess, .htpasswd and .htgroup. The script includes something like: [...] print HT "<Limit GET>\n"; print HT "require group $user\n"; print HT "</Limit>\n"; [...] The $user is supplied by the user and there is no character-filter. Therefore everyone can create a .htaccess file in the admin-directory with any content. The corrupted arguments may be delivered by a HTML file (only thing to regard is you cannot supply newline-characters by input-fields but using a textarea does the trick) or simply by curl. As an attacker can edit the .htaccess file however he wants there may be a lot of possible attacks. For example a phishing attack can be constructed. An attacker can use the .htaccess "Redirect" keyword and redirect the user to a fake login page. Furthermore i would like to emphraze the bad idea of just limiting GET requests. If a shop-owner protects his admin-directory with this automaticly created .htaccess file an attacker may still use POST requests to enter the directory. *) Workaround: + Delete the pwd.cgi file + Set the file permissions to not-accessible ("chmod 000 pwd.cgi")