:::SPAS3C-WV-005:::Vulnerability in Joomla! Core (Back-end) <= 1.5.19

About two months ago, i found several vulnerabilities in Joomla! v<= 1.5.19 and these are my advisories. This one was published on Joomla! Security Center: here

• Project: Joomla!
• Severity: Medium
• Versions: 1.5.19 and all previous 1.5 releases
• Exploit type: XSS Injection
• Reported Date: 2010-June-8

Back-end was vulnerable to XSS/HTML Code Injection. Get var "menutype" used in "com_menus" (core component) allowed the injection.

Proof-of-Concept:

http://[HOST]/[JOOMLA-PATH]/administrator/index.php?option=com_menus&task=view&menutype=mainmenu%22%20onmouseover=%22alert%28%27Discovered%20by%20Jose%20A.%20Vazquez%27%29;

Some screenshots:

Fig.1: XSS triggered in Joomla! Back-end

Fig.2: Code injected.

Be safe ;)

:::SPAS3C-WV-004:::Session Hijacking in Steam WebSite

About two months ago, my little girl gave me a great present for my birthday and i got Call of Duty Modern WarFare 2 (I <3 C0D).

Lots of minutes of game later, I decided to check security in Steam Website and i got very interesting results.

WebSite was vulnerable to XSS/HTML Injection and it could be exploited to steal cookies of users. I made a PoC showing how to launch the vulnerabilities using any browser (where xss was allowed) or "steam" schema uri (steam://openurl/) due to steam used its own internal browser.

The "steam browser" had/has some limitations:

• This browser didn't/doesn't allow to change the url -> Solution was schema uri.

• This browser had/has an url length restriction -> Solution was to use an evil JS file hosted anywhere.

• So, these would be simple PoCs.Get var "os" was vulnerable: http://store.steampowered.com/search/?os=mac%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E%3C!--&category1=998&category2=9

• Get var "category1" was vulnerable: http://store.steampowered.com/search/?os=mac&category1=998%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E%3C!--&category2=9
  

Fig.1: Triggering one simple PoC.

Fig. 2: Session Hijacking PoC.

I also recorded a video showing how the issue could be exploited.

Watch in youtube: here

I made my game more secure but they (steam-website security team) didn't give me a present like a new nice game.

Be safe ;)

:::SPAS3C-WV-003:::Google IO XSS/HTML Injection Vulnerability

This post is about a bug discovered in Google IO (XSS/HTML Injection)

Risk: Medium

"Google I/O brings together thousands of developers for two days of deep technical content, focused on building the next generation of web, mobile, and enterprise applications with Google and open web technologies such as Android, Google Chrome, Google APIs, Google Web Toolkit, App Engine, and more."

Source: here

Get var "error" was vulnerable to XSS/HTML code injection but some tags and javascript events were filtered trying to do more difficult the explotation.

Also i noticed that viewing source code, error var triggered a SQL error, so I tried to make a SQL Injection but no worked.

Proof of concept:

Indirect. Needed user interaction (event JavaScript: onmouseout) -> https://www.google-io.com/2010/index.cfm?fuseaction=reg.ReturnLogin&error=36%22%3E%3Ca%20href=%22http://www.malware.es%22%20onmouseout=%22alert%281%29%22%3EHOLA%20GOOGLE%3C/a%3E

Fig.1: XSS (Indirect) and HTML Injection.

Direct. Not needed user interaction (event JavaScript: onerror) -> https://www.google-io.com/2010/index.cfm?fuseaction=reg.ReturnLogin&error=36%22%3E%3Ch1%3E%3Cimg%20src=%22pepe.jpg%22%20onerror=%22alert%281%29%22%3EHI%20GOOGLE%20SECURITY%20TEAM%20I%27M%20%20ONLY%20TESTING%3C/a%3E%3C/h1%3E

Fig.2: XSS (Direct) and HTML Injection.

Be safe ;)

:::SPAS3C-SV-001:::NGINX [ENGINE X] SERVER <= 0.7.65 /0.8.39 SOURCE CODE DISCLOSURE/DOWNLOAD VULN. (CVE-2010-2263)

I found this vulnerability one week ago, but I was waiting a fucking CVE number when somebody published a similar advisory without checking. This researcher made a public disclosure in an old release and he also said that it isn't fixed when this is fake (at least Source Code Disclosure/Download got fixed with lastest releases).

Copied from ChangeLog for 0.8.40/0.7.66 (Final releases in stable/development channel):

-------------------------START-COPY-------------------------------

Changes with nginx 0.8.40 07 Jun 2010

*) Security: now nginx/Windows ignores default file stream name.

Thanks to Jose Antonio Vazquez Gonzalez.

*) Feature: the ngx_http_uwsgi_module.
Thanks to Roberto De Ioris.

*) Feature: a "fastcgi_param" directive with value starting with
"HTTP_" overrides a client request header line.

*) Bugfix: the "If-Modified-Since", "If-Range", etc. client request
header lines were passed to FastCGI-server while caching.

*) Bugfix: listen unix domain socket could not be changed during
reconfiguration.
Thanks to Maxim Dounin.

-------------------------END-COPY-------------------------------

But vulnerabilities databases seem that they didn't confirm nothing.

This is my advisory:

-------------------------START-ADVISORY-------------------------------

TITLE: NGINX [ENGINE X]
SERVER <= 0.7.65 (STABLE)/0.8.39 (DEVELOPMENT) SOURCE CODE DISCLOSURE/DOWNLOAD VULNERABILITY TESTED OS: WINDOWS XP SP3/ WINDOWS 7 HOME PREMIUM SEVERITY: HIGH CVE-NUMBER: CVE-2010-2263 IMPACT: READ/DOWNLOAD SOURCE CODE OF WEB APP FILES DISCOVERED DATE: 2010-06-04 FIXED DATE: 2010-06-07 FIXED VERSIONS: NGINX/0.8.40 AND NGINX/0.7.66 DISCOVERED BY: JOSE ANTONIO VAZQUEZ GONZALEZ ======ABOUT APPLICATION======

"nginx [engine x] is a HTTP and reverse proxy server, as well as a mail proxy server written by Igor Sysoev. It has been running for more than five years on many heavily loaded Russian sites including Rambler (RamblerMedia.com). According to Netcraft nginx served or proxied 4.70% busiest sites in April 2010. Here are some of success stories: FastMail.FM, Wordpress.com. The sources are licensed under 2-clause BSD-like license." copied from -> http://nginx.org/en/ [ref-1]

======TESTED VERSIONS=====

Unix versions are not vulnerable (it only affects to NTFS file system)

Windows Stable versions:

nginx/0.7.66 --> Not vulnerable
nginx/0.7.65 --> Vulnerable
nginx/0.7.64 --> Vulnerable
nginx/0.7.63 --> Vulnerable
nginx/0.7.62 --> Vulnerable
nginx/0.7.61 --> Vulnerable
nginx/0.7.60 --> Vulnerable
nginx/0.7.59 --> Vulnerable
nginx/0.7.58 --> Vulnerable
nginx/0.7.56 --> Vulnerable

Windows Development versions:

nginx/0.8.40 --> Not vulnerable
nginx/0.8.39 --> Vulnerable
nginx/0.8.38 --> Vulnerable
nginx/0.8.37 --> Vulnerable
nginx/0.8.36 --> Vulnerable
nginx/0.8.35 --> Vulnerable
nginx/0.8.34 --> Vulnerable
nginx/0.8.33 --> Vulnerable
nginx/0.8.32 --> Vulnerable
nginx/0.8.31 --> Vulnerable
nginx/0.8.30 --> Vulnerable

======DESCRIPTION======

This application was vulnerable to source code disclosure/download vulnerability when it was running in Windows OS (NTFS file system).

App parser couldn't handle ADS (Alternate Data Streams) and it treated a data stream as an usual file. An Attacker could read/download source code of webapps files using default data stream (unnamed): "filename::$data".

This issue is like an old security issue in Microsoft Windows IIS [ref-2].

======PROOF OF CONCEPT======

http://[IP]/[FILE]::$data

======STEPS TO REPRODUCE======

1.- Start the server.

2.- Go to http://127.0.0.1/index.html::$data

3.- Browser requests to download...yes...go to file and open it.

======REFERENCES======

[ref-1] -> http://nginx.org/

[ref-2] -> http://www.microsoft.com/technet/security/bulletin/ms98-003.mspx

======DISCLOSURE TIMELINE======

Standard Time Zone: GMT/UTC + 01:00 hour (Spain/Madrid)

[2010-06-04] => Inicial contact with vendor and sent advisory.

[2010-06-04] => Vendor response and believe that vulnerability got fixed with previous release.

[2010-06-04] => I confirm that nginx is vulnerable in Windows 7 OS.

[2010-06-04] => Vendor will try to see the issue.
[2010-06-04] => Vendor confirms the issue and he will get fixed on Monday.
[2010-06-07] => New releases out.
[2010-06-07] => I sent complete advisory and propose as disclosure date on Wednesday.
[2010-06-10] => Second chance to confirm public disclosure.
[2010-06-10] => Vendor agree.
[2010-06-11] => Forced to public disclosure.

======CREDITS=======

Jose Antonio Vazquez Gonzalez,
Telecom. Engineer & Sec. Researcher.
http://spa-s3c.blogspot.com/

Thanks to Ruben Santamarta (@reversemode) and Jose Maria Alonso (@maligno) for their support in other issues.

-------------------------END-ADVISORY-------------------------------

This is a visual Proof Of Concept:

Watch on youtube -> http://www.youtube.com/watch?v=DvQtvV8kQhY

Be good (responsible disclosure) has disadvantages...bye bye my first software advisory :(

Update: Thanks to exploits-db and security-focus because they (will) have updated their databases and (will) have published my advisory.

Be safe ;)

:::SPAS3C-WV-002:::Google App (Ventures) BSQLi Vulnerability

One month ago, I found serveral vulnerabilities in Google's sites.

These issues got fixed all and I want to say that Google Security Team did a good job and they fixed it soon.

All issues was discovered between 4 May and 9 May (year 2010, of course).

This issue is the most important in my opinion: Blind SQL Injection in googleventures.com

Risk: High

Google Ventures is Google’s venture capital arm.

We do primarily three things:

1. Seek out the most innovative and interesting entrepreneurs and companies we can find
2. Perform in-depth due diligence and invest in those we are most excited about
3. Do everything we can to help those companies succeed
   

We invest for financial return, across all sectors and in all stages of a company’s growth. We are particularly interested in areas where access to our team, facilities, technology or other resources can help a company become more successful, but we do not limit our investments to those of strategic interest to Google – we look for companies and people that have the best opportunity to create significant, disruptive and innovative ventures.

Source: here

Site was made using PHP+MySQL (some parts) and GET var "jobid" vulnerable to injection of SQL code.

Proofs Of Concept (Searching MySQL version)

Return: 1=1 (True), so MySQL version is 5

Link PoC -> http://jobs.googleventures.com/jobdetail.php?jobid=39109+AND+IF(substring(@@version,1,1)=5,1,0)=1--

Fig. 1: BSQLi. True result.

Return 1=0 (False), so MySQL version isn't 4.

Link PoC -> http://jobs.googleventures.com/jobdetail.php?jobid=39109+AND+IF(substring(@@version,1,1)=4,1,0)=1--

Fig. 2: BSQLi. False result.

Also I tried to get a SQL Injection, with "Union Select" Statement but It didn't work.

Fig. 3: Trying SQL Injection "Union Select". MySQL error.

I didn't want to do a further research because I considered that it was enough.

Be safe ;)

Mini-estudio de Strings (SingleQuote vs DoubleQuote) en PHP

Leyendo el blog de Skylined, su última entrada me ha inspirado para realizar un análisis similar, en español y algo más estadístico.

Cuando programamos en PHP, podemos escribir Strings o cadenas de la siguiente forma:

$string="Esto es un simple string con comillas dobles";
o bien,
$string='Esto es un simple string con comillas simples';

Esta entrada trata de realizar un estudio o comparación entre ambos métodos.

En primer lugar hay que aclarar que la forma en que PHP destina un entrecomillado de otro es diferente. Las comillas dobles se evalúan, esto significa que se pueden emplear de la siguiente forma:

$stringconcat="string2";
$string="Esto es un string con $stringconcat";

En este ejemplo, las comillas dobles tienen primero que evaluar la variable $stringconcat y sustituir su contenido, con lo cual, realiza una evaluación, si hay más variables realizará X evaluaciones.

Sin embargo no se puede emplear (esto está mal):

$stringconcat="string2";
$string='Esto es un string con $stringconcat';

Componiendo un sencillo Script PHP que realice un determinado número de ejecuciones con diferentes tipos de Strings y almacene los resultados temporales en un fichero, tal como este:

$handle=fopen("resultado.txt","a");
for($j=1;$j<=50;$j++){
//DB sin String...
$time = microtime();
for($i=0;$i<1000;++$i){
$$i = "Un String sin un numero";
}
fwrite($handle,(microtime()-$time)."\t");
//DB sin String...
$time = microtime();
for($i=0;$i<1000;++$i){
$$i = 'Un String sin un numero';
}
fwrite($handle,(microtime()-$time)."\t");
//DB con String...
$time = microtime();
for($i=0;$i<1000;++$i){
$$i = "Un String $i con un numero";
}
fwrite($handle,(microtime()-$time)."\t");
//DQ concatenado
for($i=0;$i<1000;++$i){
$$i = "Un String ".$i." concatenado con numero";
}
fwrite($handle,(microtime()-$time)."\t");
//SQ concatenado
$time = microtime();
for($i=0;$i<1000;++$i){
$$i = 'Un String '.$i.' concatenado con numero';
}
fwrite($handle,(microtime()-$time)."\r\n");
}
fclose($handle);
echo "Terminado! Ahora importe los datos a una tabla de excel...";

Donde realizamos 50 ejecuciones, separamos entre 5 tipos de strings: Dobles Comillas (solas), Comillas simples (solas), Dobles comillas con numero, Dobles comillas con 1 concatenación y Comillas simples con 1 concatenación. Almacenamos los resultados temporales en un fichero resultado.txt. Posteriormente estos datos se importan en excel y he elaborado unas gráficas que arrojan algunos resultados interesantes.

Fig.1: Tiempos de 50 ejecuciones.

Fig.2: Promedio de 50 ejecuciones.

En estas gráficas se aprecia como las dobles comillas con una concatenación son las que mayor retardo de ejecución producen, seguido por las comillas dobles con el número. A continuación las comillas simples con una concatenación y finalmente las dobles comillas y las comillas simples.

De todo esto se deduce que las comillas simples son la mejor opción de cara al rendimiento y que en general el empleo de comillas dobles no es acertado (debido a los retardos de las evaluaciones). Sin duda, esto va a cambiar mi forma de trabajar con Strings en PHP.

Be safe ;)

Más y más WebSites desde el gobierno (ZP 2.0)

Al hilo de lo sucedido hace algún tiempo en el estreno de la eu2010 y puesto que a día de hoy el señor Zapatero y su gobierno no despiertan muchos entusiasmos, con sus recortes, "tijeretazos", etc. He decidido escribir esta entrada como crítica para la infinidad de nuevos WebSites fomentados por el gobierno.

Sinceramente, lo que más me ha llamado la atención, al margen de los ejemplos que voy a mostrar, son los casos de mayor riesgo, que evidentemente no voy a divulgar, pero que me hacen llegar a una conclusión: La seguridad de los WebSites no importa al gobierno. Lo que realmente parece importar es la idea: Crear portales a discreción.

Estos casos, en su mayoría inyecciones de código en la DB e inclusiones de archivo local (LFI), se encuentran en bases de datos Oracle, MS Server, MySQL, etc. Empleando lenguajes de servidor PHP, ASP, ASPX, etc.

En ciertos casos (al inicio de la legislatura), se emplea la tecnología más recomendada o más cara, pero sin embargo, la seguridad es cero. Otros (ya en crisis), denotan las prisas por lograr un portal finalizado lo antes posible y al menor precio, dando igual emplear una DB totalmente anticuada y un servidor compartido, donde todas (y no es broma, pocas se salvan), incluida esta misma, son vulnerables (seguridad cero de nuevo).

La cuestión final que quiero aclarar es que este gobierno, el gobierno del Sr. Rodriguez Zapatero, se ha dedicado a crear WebSites para casi todo lo que se le ha ido ocurriendo, no importándole en absoluto la seguridad de los portales, siendo esta seguridad como una cuestión de tecnología robusta y al mismo tiempo, derrochando todo el dinero posible.

Otra cuestión es el hecho de desmentir el mencionado caso de la eu2010, como un caso de no hack, puesto que para ellos todo lo que no afecte al WebServer no será considerado como hack. Con esta mentalidad, de darle igual la seguridad de un usuario final (caso de un XSS o HTML injection) y preocuparse exclusivamente por la seguridad de su servidor, es la mayor de las similitudes (mundo seguridad vs. mundo real) que sufrimos actualmente.

Dicho todo esto, dejo algunas "simpáticas" capturas de nuestro máximo representante político, en algunas de sus famosas WebSites actuales y no actuales. Se dirá que son "pintadas", que no son hacks o...para qué tanto si hubiera sido más fácil hacer "DesignMode=ON" y comenzar a retocar. Pero la realidad es que son vulnerabilidades Web, que son cuestiones de seguridad y que deben ser revisadas.

Site: http://www.mpt.es/busqueda.html
Metodo: POST
Tipo Vuln: HTML Injection

Fig.1: Zp en mpt.es

Site: http://www.dgt.es/portal/buscar/
Metodo: POST
Tipo Vuln: HTML Injection

Fig.2: Zp en dgt.es

Site: http://www.spainun.org/pages/busqueda.cfm
Metodo: POST
Tipo Vuln: HTML Injection

Fig.3: Zp en spainun.org

Site: http://www.icex.es/icex/cda/controller/pageICEX/0,6558,5518394_5518983_5537315_0,00.html?ingresa-txt=%22%3E%3Cimg+src%3D%22http%3A%2F%2Fwww.rankia.com%2Fblog%2Fgenarofragueiro%2Fuploaded_images%2Fzapatero-preocupado-760376.jpg%22+width%3D%2240%25%22+height%3D%2240%25%22+title%3D%22Zapatero+sexy...%22%2F%3E&canal=5518971&x=0&y=0

Metodo: GET
Tipo Vuln: HTML Injection

Fig.4: Zp en icex.es

Sin lugar a dudas este último es mi preferido, pues se envía por GET y con la simple URL podemos lanzar la inyección. Comprobar aqui

Como nota final quiero aclarar que esto es una simple muestra en un corto periodo de testeo, las pruebas se realizaron exclusivamente en los buscadores de ciertos sites, nada de testeos profundos de otras variables, otros formularios, etc. Por otra parte me gustaría decir, que todo esto fue reportado hace más de 6 meses, pero que los administradores de los sites: a) les ha dado igual. b) los filtros anti-spam se han comido mis advisories.

Be safe ;)