Plusieurs vulnérabilités détectée dans POSH <= 3.1.1

CrashFR de Sysdream a mis le doigt sur plusieurs failles (Local File Inclusion, Cross-Site Scripting (XSS) and Information Disclosure) au sein de POSH 3.1.1. POSH (Portaneo Open Source Homepage) est une solution personnalisable à la iGoogle/Netvibes utilisée principalement par les entreprises pour leur intranet.

Si vous utilisez une version inférieure ou égale à POSH 3.1.1, passez rapidement à la 3.2.

POSH <= 3.1.1 Multiple Vulnerabilities

POSH (Portaneo Open Source Homepage) is a personalizable interface (Netvibes, iGoogle) that can be used in a web application or educational / enterprise intranet context. Enterprise version adds social network, notebooks and search feature.

Local File Inclusion, Cross-Site Scripting (XSS) and Information Disclosure vulnerabilities were identified within POSH version 3.1.1

POSH <= 3.1.1 Multiple Vulnerabilities

//----- Advisory

Program          : POSH 3.1.1 and prior
Vendor           : www.portaneo.com
Homepage         : http://sourceforge.net/projects/posh/
Discovery        : 2011/09/19
Author Contacted : 2011/09/20
Found by         : CrashFr
This Advisory    : CrashFr

//----- Application description


POSH (Portaneo Open Source Homepage) is a personalizable interface (Netvibes, iGoogle) that can be used in a web application or educational / enterprise intranet context. Enterprise version adds social network, notebooks and search feature.


//----- Description of vulnerability


Local File Inclusion, Cross-Site Scripting (XSS) and Information Disclosure vulnerabilities were identified within POSH version 3.1.1


//----- Proof Of Concept


--- Information disclosure ---
- http://localhost/posh/portal/login.php?lang=fr-en
        - Vulnerability at includes/sessions.inc.php
                Replace:
                if (    preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) {
                        $_SESSION['lang'] = $_GET["lang"];
                By:
                if ((preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) && is_file('../l10n/'.$_GET["lang"].'/lang.php')) {
                        $_SESSION['lang'] = $_GET["lang"];


--- XSS ---
- http://localhost/posh/portal/login.php?message=XSS%20Catched%20!%22%29%29;alert%28%22XSS%22%29;//
        - Vulnerability at: templates/default/login.php line 42
                Replace: if ($message!='') echo '<font color="#ff0000"><script type="text/javascript">document.write(lg("'.$message.'"));</script></font><br /><br />';
                By: if ($message!='') echo '<font color="#ff0000"><script type="text/javascript">document.write(lg("'.htmlspecialchars($message).'"));</script></font><br /><br />';

- http://localhost/posh/admin/login.php?extid=ok%22%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E
        - Vulnerability at: templates/default/login_adminsimplified.php line 93
                Replace: <input type="hidden" name="extid" maxlength="16" value="<?php echo $extid; ?>" class="thinbox" />
                By: <input type="hidden" name="extid" maxlength="16" value="<?php if(is_int($extid)){ echo $extid; } ?>" class="thinbox" />
- http://localhost/posh/admin/index.php?extid=1%29;alert%28%27XSS%27
        - Vulnerability at: templates/default/index_adminsimplified.php line 67 and 70
                Replace: $p.admin.widgets.loadModExtId(<?php echo $extid; ?>);
                By: $p.admin.widgets.loadModExtId(<?php if(is_int($extid)){ echo $extid; } ?>);
                Replace: $p.admin.widgets.refreshIcons(icon,<?php echo $extid; ?>);
                By: $p.admin.widgets.refreshIcons(icon,<?php if(is_int($extid)){ echo $extid; } ?>);


--- Local File Inclusion ---
- http://localhost/posh/portal/scr_changelang.php => POST lang=../../../../../../etc/passwd%00
        POST http://localhost/posh/portal/scr_changelang.php HTTP/1.1
        lang=../../../../../../../../../../../../../../../../etc/passwd%00

        - Call http://localhost/posh/portal/moduleff.php for example to see the result (a lot of page use __LANG to include lang file)
        - Vulnerability at portal/scr_changelang.php line 67
                Replace: $_SESSION['lang']=$lang;
                By: if ((preg_match( '/^[a-z]{2}$/', $_GET["lang"] ) || preg_match( '/^[a-z]{2}\-[a-z]{2}$/', $_GET["lang"] )) && is_file('../l10n/'.$_GET["lang"].'/lang.php')) {
                        $_SESSION['lang']=$lang;
                    }


//----- Solution

Apply patchs
Upgrade POSH to 3.1.2


//----- Vulnerability Timeline

2011-09-20 - Reported to vendor
2011-09-21 - Vendor Reply
2011-09-25 - Vendor released POSH 3.1.2
2011-10-10 - Vulnerability Disclosed


//----- Credits


Page d’accueil


crashfr at sysdream dot com


//----- Greetings

HZV (http://www.hackerzvoice.net)