toendaCMS multiple vulnerabilites

SEC-CONSULT Security Advisory 20051107-0

=============================================================================

title: toendaCMS multiple vulnerabilites

program: toendaCMS

vulnerable version: <0.6.2

homepage: www.toenda.com

found: 2005-10-25

by: Bernhard Mueller / SEC-CONSULT / www.sec-consult.com

=============================================================================

 

Vendor description:

---------------

 

The toendaCMS Content Management and Weblogging tool gives you a modern, professional publishing system, based on an SQL and/or XML database.

 

 

Vulnerabilty overview:

---------------

 

toendaCMS contains various security flaws. These include:

 

* theft of CMS usernames and passwords (XML database mode)

* session theft (XML database mode)

* directory traversal / reading of arbitrary files (XML database mode)

* arbitrary file uploads

 

 

Vulnerability details:

---------------

 

1) Account data is stored within the webroot (XML mode):

 

http:// tcms.webserver.com/data/tcms_user/<random-val>.xml, where <random val> is string composed of 5 bytes (e.g. 2ac336ff0d.xml). Each XML file contains username (base64) and password (MD5) of a single user.

 

This is particularly dangerous if the webserver allows directory listing.

 

 

2) Session data is stored within the webroot:

 

http:// tcms.webserver.com/engine/admin/<user-id>.xml (XML mode). The session files are created once a user logs in to the CMS, so we just have to monitor this directory to steal his credentials.

 

This is particularly dangerous if the webserver allows directory listing.

 

 

3) Directory Traversal / reading of arbitrary files (XML mode):

 

http:// tcms.webserver.com/engine/admin/admin.php?id_user=../../../../../../etc/passwd

 

 

4) Arbitrary file uploads:

 

Once we have gained access to the administrator interface, we can use the gallery scripts to upload arbitrary files to:

 

http:// tcms.webserver.com/data/images/albums/

 

No content-type or file validation checks are in place, so this is the easiest way to get shell access.

 

 

Additional Remarks:

---------------

 

These flaws were found during a pentest, in an environment with MAGIC_QUOTES_GPC activated. Please do NOT try to use toendaCMS without MAGIC_QUOTES and other safeguards, unless you plan to run a honeypot or have another particular reason for being very vulnerable.

 

 

Vendor status:

---------------

vendor notified: 2005-10-26

vendor response: 2005-10-30

patch available: 2005-11-01

 

 

The issues described in this advisory have been addressed in the latest version of toendaCMS (0.6.2 stable). Download at:

 

www.toenda.com/de/data/files/Software/toendaCMS_Version_0.6.0_Stable/toendaCMS_0.6.2_Stable.zip

 

 

General remarks

---------------

We would like to apologize in advance for potential nonconformities and/or known issues.

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Unternehmensberatung GmbH

 

Office Vienna

Blindengasse 3

A-1080 Wien

Austria

 

Tel.: +43 / 1 / 409 0307 - 570

Fax.: +43 / 1 / 409 0307 - 590

Mail: office at sec-consult dot com

www.sec-consult.com

 

EOF Bernhard Mueller / @2005

bmu at sec-consult dot com