Security Advisory - Curesec Research Team 1. Introduction Affected Product: CouchCMS 1.4.5 Fixed in: 1.4.7 Fixed Version Link: http://www.couchcms.com/products/ Vendor Website: http://www.couchcms.com/ Vulnerability Type: XSS & Open Redirect Remote Exploitable: Yes Reported to vendor: 11/17/2015 Disclosed to public: 12/21/2015 Release mode: Coordinated Release CVE: n/a Credits Tim Coen of Curesec GmbH 2. Overview CVSS Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Description CouchCMS 1.4.5 contains two reflected XSS and one open redirect vulnerability. Successful exploitation may lead to the injection of JavaScript keyloggers, the stealing of cookies, or the bypassing of CSRF protection. 3. Details XSS 1 When displaying a post, the name of any additional GET parameters is echoed unencoded, leading to XSS. Proof of Concept: http://localhost/CouchCMS-1.4.5/blog.php?p=5&foo"><script>alert(2)</script>bar=1 Code: function getPaginationString( $page = 1, $totalitems, $limit = 15, $adjacents = 1, $targetpage = "/", $pagestring = "?page=", $prev_text, $next_text, $simple ){ [...] $pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>";\ [...] $pagination .= "<a href=\"" . $targetpage . $pagestring . $counter . "\">$counter</a>"; [...] $pagination .= "<a href=\"" . $targetpage . $pagestring . $lpm1 . "\">$lpm1</a>"; $pagination .= "<a href=\"" . $targetpage . $pagestring . $lastpage . "\">$lastpage</a>"; [... (all $targetpage . $pagestring are affected) ...] } XSS 2 When displaying comments, the name of any additional GET parameters is echoed unencoded, leading to XSS. Proof of Concept: http://localhost/CouchCMS-1.4.5/couch/?o=comments&foo"><script>alert(1)</script>bar=1 Code: /couch/edit-comments.php <ul class="filter"> <li><a <?php if(is_null($approved)) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>"><?php echo $FUNCS->t('all'); ?></a> | </li> <li><a <?php if($approved===0) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=0"><?php echo $FUNCS->t('unapproved'); ?> </a> | </li> <li><a <?php if($approved==1) echo 'class="current"'; ?> href="<?php echo k_create_link(array('status', 'pg')); ?>&status=1"><?php echo $FUNCS->t('approved'); ?></a></li> <?php if( $page_title ){ echo '<li> (of <b><i>'.$page_title.'</i></b>)</li>'; } ?> </ul> [...] <p class="comment-actions"> <a title="<?php echo $text_approve; ?>" href="<?php echo $approve_link; ?>"><?php echo $text_approve; ?></a> | <?php if( $rec['approved'] ){ ?> <a title="<?php echo $FUNCS->t('view'); ?>" href="<?php echo $comment_link; ?>" target="_blank"><?php echo $FUNCS->t('view'); ?></a> | <?php } ?> <a title="<?php echo $FUNCS->t('edit'); ?>" href="<?php echo $edit_link; ?>"><?php echo $FUNCS->t('edit'); ?></a> | <a title="<?php echo $FUNCS->t('delete'); ?>" onclick="return confirm('<?php echo $FUNCS->t('confirm_delete_comment'); ?>');" href="<?php echo $delete_link; ?>"><?php echo $FUNCS->t('delete'); ?></a> </p> Open Redirect The filter which checks if a user supplied redirect value leads to external pages can be bypassed by an attacker. Proof of Concept (Only works for logged in victims or after login): http://localhost/CouchCMS-1.4.5/couch/login.php?redirect=//google.com Code: /couch/auth/auth.php function redirect( $dest ){ global $FUNCS, $DB; // sanity checks $dest = $FUNCS->sanitize_url( trim($dest) ); if( !strlen($dest) ){ $dest = ( $this->user->access_level < K_ACCESS_LEVEL_ADMIN ) ? K_SITE_URL : K_ADMIN_URL . K_ADMIN_PAGE; } elseif( strpos(strtolower($dest), 'http')===0 ){ if( strpos($dest, K_SITE_URL)!==0 ){ // we don't allow redirects external to our site $dest = K_SITE_URL; } } $DB->commit( 1 ); header( "Location: ".$dest ); die(); } 4. Solution To mitigate this issue please upgrade at least to version 1.4.7: http://www.couchcms.com/products/ Please note that a newer version might already be available. 5. Report Timeline 11/17/2015 Informed Vendor about Issue 11/18/2015 Vendor sends fixes for confirmation 11/20/2015 Verified fixes 11/24/2015 Vendor releases fix 12/21/2015 Disclosed to public Blog Reference: https://blog.curesec.com/article/blog/CouchCMS-145-XSS-amp-Open-Redirect-126.html -- blog: https://blog.curesec.com tweet: https://twitter.com/curesec Curesec GmbH Curesec Research Team Romain-Rolland-Str 14-24 13089 Berlin, Germany