[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CY4PR12MB1141518BEAB7E0FAD34D0457DA210@CY4PR12MB1141.namprd12.prod.outlook.com>
Date: Thu, 9 Mar 2017 17:36:39 +0000
From: Seth Art <sart@...nskycorp.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE Request: Joomla! FLEXIcontent - Incorrect Authorization
(Authorization Bypass)
-----------
Vendor:
-----------
FLEXIcontent (http://www.flexicontent.org) is an advanced content management system developed to greatly enhance the native content management of Joomla!
-----------------------------------------
Affected Products/Versions:
-----------------------------------------
flexicontent-cck-3.0.13
flexicontent-cck-3.1.0-rc
Note: Previous versions may be affected
-----------------
Description:
-----------------
Title: Joomla! FLEXIcontent - Incorrect Authorization (Authorization Bypass)
CWE-863: Incorrect Authorization (https://cwe.mitre.org/data/definitions/863.html)
Detailed write-up: http://www.openskycorp.com/resource-center/blog/joomla-flexicontent-incorrect-authorization/
Researcher: Seth Art
CWE-863 Description: "The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions."
The FLEXIcontent plugin uses a query string parameter, task, which specifies the action to perform on a FLEXIcontent article. If an unauthenticated actor provides any value other than edit or a blank value to the task parameter, the actor is able to view the restricted FLEXIcontent article, regardless of the assigned permissions. Articles are sequentially numbered, which would allow an actor exploiting this vulnerability to gain read-only access to all FLEXIcontent articles by iterating through article identifiers.
---------------
POC:
---------------
http://host/index.php/content_page/#/#?task=abcd
http://host/index.php/content_page/2/6?task=foo
http://host/index.php/content_page/2/7?task=foo
http://host/index.php?option=com_flexicontent&view=item&id=#&task=abcd (if Search Engine Friendly URLs are disabled)
-------------
Solution:
-------------
Upgrade to flexicontent-cck-3.1.1 or greater
-----------------------------
Disclosure Timeline:
-----------------------------
2016-09-28: Notified FLEXIcontent author of vulnerability.
2016-09-28: FLEXIcontent author acknowledges vulnerability and confirms it will be fixed.
2016-10-31: FLEXIcontent v3.1.1 is released and silently fixes vulnerability.
2016-11-30: Researcher tests v3.1.1 and determines vulnerability has been fixed.
2016-01-31: Researcher asks the author to mention the security issue in release notes (no response).
2017-03-06: Public disclosure
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
