Title:
======
SilverStripe Framework CMS 3.0.5 - Multiple Vulnerabilities
Date:
=====
2013-09-23
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=1084
VL-ID:
=====
1084
Common Vulnerability Scoring System:
====================================
3.9
Introduction:
=============
SilverStripe CMS is an open source web content management system used by governments, businesses,
and non-profit organisations around the world. It is a power tool for professional web development teams,
and web content authors rave about how easy it is to use.
As a platform, SilverStripe CMS is used to build websites, intranets, and web applications. The modern
architecture of SilverStripe CMS allows organisations to keep pace with innovation on the web. SilverStripe
CMS enables websites and applications to contain stunning design, great content, and compelling interactive
and social functions.
Besides a powerful and intuitive content authoring application, SilverStripe CMS contains a powerful PHP5-based
programming framework. The SilverStripe Framework brings immense flexibility and ease in customising your site
and provides fundamentals such as security models, workflow, caching, and multiple language and subsite support.
SilverStripe CMS is open source, underpinned by public documentation, free code, and a developer community.
It is based on open standards and supports multiple technology platforms. SilverStripe CMS is built and
commercially supported by SilverStripe Ltd., a software company responsible for ensuring innovation, focus,
and quality in the software. SilverStripe Ltd., its Partners around the world, and the global SilverStripe
Developer Network provide commercial services around designing, implementing, and customising websites and
applications based on SilverStripe CMS.
(Copy of the Vendor Homepage: http://www.silverstripe.org/introduction/ )
Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple persistent input validation web vulnerabilities in the SilverStripe v3.0.5 CMS.
Report-Timeline:
================
2013-09-23: Public Disclosure (Vulnerability Laboratory)
Status:
========
Published
Affected Products:
==================
SilverStripe
Product: Content Management System & Framework 3.0.5
Exploitation-Technique:
=======================
Remote
Severity:
=========
Medium
Details:
========
1.1
A persistent input validation web vulnerability is detected in the official SilverStripe v3.0.5 Content Management System.
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application side).
The vulnerability is located in the `Print` module of the groups and roles settings function when processing to request via
POST method manipulated `first & lastnames`. Remote attackers can include a new role bound to an user configuration with own
injected script code (payload). The injected context will be executed in the edit id list and the main index role/groups list.
Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged web-application user
account with a password. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers),
account steal via persistent web attacks, persistent phishing or persistent manipulation of vulnerable module context.
Vulnerable Application(s):
[+] SilverStripe v3.0.5 - Content Management System
Vulnerable Module(s):
[+] Add Roles - Name
[+] Add Groups - Gruppenname
Vulnerable Parameter(s):
[+] firstname & lastname
[+] even valCMS_ACCESS_ReportAdmin > Form_ItemEditForm_Permissions_CMSACCESSAssetAdmin
Affected Module(s):
[+] Item Edit - Sicherheit > Groups & Roles User Listing
[+] Print (Role/Group) - Item Listing
1.2
A persistent input validation web vulnerability is detected in the official SilverStripe v3.0.5 Content Management System.
The bug allows an attacker (remote) to implement/inject malicious own malicious persistent script codes (application side).
The vulnerability is located in the `message validation` module when processing to request via POST method manipulated
`CEO` or `Revenue` parameters. The injected script code will be stored in the users profile of the company. The code gets
executed by in the user profile company.
Exploitation of the persistent web vulnerability requires low user interaction and a local low privileged web-application
user account with a password. Successful exploitation of the vulnerability can lead to persistent session hijacking (customers),
account steal via persistent web attacks, persistent phishing or or persistent manipulation of vulnerable module context.
Vulnerable Application(s):
[+] SilverStripe v3.0.5 - Content Management System
Vulnerable Module(s):
[+] Message Validation
Vulnerable Parameter(s):
[+] Form_ItemEditForm_ (CEO & Revenue)
Affected Module(s):
[+] Admin > Company Listing
Proof of Concept:
=================
1.1
The first persistent input validation web vulnerability can be exploited by remote attackers with low privileged application user accounts and
low required user interaction. For demonstration or reproduce ...
PoC: Groups & Rollen (Roles) - Print
SilverStripe - Sicherheit
SilverStripe - Sicherheit
Vorname
Nachname
E-Mail
Gedruckt am 11:44pm, 22/09/2013
Gedruckt von a%20>"