SEC-CONSULT Security Advisory 20051107-0
=============================================================================
title: toendaCMS multiple vulnerabilites
program: toendaCMS
vulnerable version: <0.6.2
homepage: www.toenda.com
found: 2005-10-25
by: Bernhard Mueller / SEC-CONSULT / www.sec-consult.com
=============================================================================
Vendor description:
---------------
The toendaCMS Content Management and Weblogging tool gives you a modern, professional publishing system, based on an SQL and/or XML database.
Vulnerabilty overview:
---------------
toendaCMS contains various security flaws. These include:
* theft of CMS usernames and passwords (XML database mode)
* session theft (XML database mode)
* directory traversal / reading of arbitrary files (XML database mode)
* arbitrary file uploads
Vulnerability details:
---------------
1) Account data is stored within the webroot (XML mode):
http:// tcms.webserver.com/data/tcms_user/<random-val>.xml, where <random val> is string composed of 5 bytes (e.g. 2ac336ff0d.xml). Each XML file contains username (base64) and password (MD5) of a single user.
This is particularly dangerous if the webserver allows directory listing.
2) Session data is stored within the webroot:
http:// tcms.webserver.com/engine/admin/<user-id>.xml (XML mode). The session files are created once a user logs in to the CMS, so we just have to monitor this directory to steal his credentials.
This is particularly dangerous if the webserver allows directory listing.
3) Directory Traversal / reading of arbitrary files (XML mode):
http:// tcms.webserver.com/engine/admin/admin.php?id_user=../../../../../../etc/passwd
4) Arbitrary file uploads:
Once we have gained access to the administrator interface, we can use the gallery scripts to upload arbitrary files to:
http:// tcms.webserver.com/data/images/albums/
No content-type or file validation checks are in place, so this is the easiest way to get shell access.
Additional Remarks:
---------------
These flaws were found during a pentest, in an environment with MAGIC_QUOTES_GPC activated. Please do NOT try to use toendaCMS without MAGIC_QUOTES and other safeguards, unless you plan to run a honeypot or have another particular reason for being very vulnerable.
Vendor status:
---------------
vendor notified: 2005-10-26
vendor response: 2005-10-30
patch available: 2005-11-01
The issues described in this advisory have been addressed in the latest version of toendaCMS (0.6.2 stable). Download at:
www.toenda.com/de/data/files/Software/toendaCMS_Version_0.6.0_Stable/toendaCMS_0.6.2_Stable.zip
General remarks
---------------
We would like to apologize in advance for potential nonconformities and/or known issues.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH
Office Vienna
Blindengasse 3
A-1080 Wien
Austria
Tel.: +43 / 1 / 409 0307 - 570
Fax.: +43 / 1 / 409 0307 - 590
Mail: office at sec-consult dot com
www.sec-consult.com
EOF Bernhard Mueller / @2005
bmu at sec-consult dot com