Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 9 Mar 2017 17:36:39 +0000
From: Seth Art <sart@...nskycorp.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE Request: Joomla! FLEXIcontent - Incorrect Authorization
 (Authorization Bypass)

-----------
Vendor:
-----------
FLEXIcontent (http://www.flexicontent.org) is an advanced content management system developed to greatly enhance the native content management of Joomla!

-----------------------------------------
Affected Products/Versions:
-----------------------------------------
flexicontent-cck-3.0.13
flexicontent-cck-3.1.0-rc
Note: Previous versions may be affected

-----------------
Description:
-----------------
Title: Joomla! FLEXIcontent - Incorrect Authorization (Authorization Bypass)
CWE-863: Incorrect Authorization (https://cwe.mitre.org/data/definitions/863.html)
Detailed write-up: http://www.openskycorp.com/resource-center/blog/joomla-flexicontent-incorrect-authorization/
Researcher: Seth Art

CWE-863 Description: "The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions."

The FLEXIcontent plugin uses a query string parameter, task, which specifies the action to perform on a FLEXIcontent article.  If an unauthenticated actor provides any value other than edit or a blank value to the task parameter, the actor is able to view the restricted FLEXIcontent article, regardless of the assigned permissions.  Articles are sequentially numbered, which would allow an actor exploiting this vulnerability to gain read-only access to all FLEXIcontent articles by iterating through article identifiers.

---------------
POC:
---------------
http://host/index.php/content_page/#/#?task=abcd
http://host/index.php/content_page/2/6?task=foo
http://host/index.php/content_page/2/7?task=foo
http://host/index.php?option=com_flexicontent&view=item&id=#&task=abcd (if Search Engine Friendly URLs are disabled)

-------------
Solution:
-------------
Upgrade to flexicontent-cck-3.1.1 or greater

-----------------------------
Disclosure Timeline:
-----------------------------
2016-09-28: Notified FLEXIcontent author of vulnerability.
2016-09-28: FLEXIcontent author acknowledges vulnerability and confirms it will be fixed.
2016-10-31: FLEXIcontent v3.1.1 is released and silently fixes vulnerability.
2016-11-30: Researcher tests v3.1.1 and determines vulnerability has been fixed.
2016-01-31: Researcher asks the author to mention the security issue in release notes (no response).
2017-03-06: Public disclosure

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ