[MajorSecurity Advisory #42]webblizzard CMS - Cross Site Scripting and Session fixation Issues
Product: webblizzard CMS
Remote-Exploit: yes
Vendor-URL: http://www.webblizzard.de/
Vendor-Status: informed
Advisory-Status: published
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de
http://www.majorsecurity.de/index_2.php?major_rls=major_rls42
webblizzard CMS is a Content Management System.
Cross Site Scripting:
Input passed directly to the "Suchzeile" parameter in "index_cms.php" is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Session fixation:
The Cookie variable "PHPSESSID" can be set to a malicious and arbitrary value.
2.1 Classification:
Session Fixation is an attack technique that forces a user's session ID to an explicit value.
Depending on the functionality of the target web site, a number of techniques can be utilized to "fix" the session ID value.
These techniques range from Cross-site Scripting exploits to peppering the web site with previously made HTTP requests.
After a user's session ID has been fixed, the attacker will wait for them to login.
Once the user does so, the attacker uses the predefined session ID value to assume their online identity.
2.Regenerate SID on each request:
A powerful countermeassure against session fixation is to "regenerate" session identifier (SID) on each request.
This means that although attacker may trick a user into accepting a known SID, the SID will be invalid when attacker attempts to re-use the SID.
if ( ! isset( $_SESSION['SERVER_GENERATED_SID'] ) ) {
session_destroy(); // destroy all data in session
}
session_regenerate_id(); // generate a new session identifier
$_SESSION['SERVER_GENERATED_SID'] = true;
http://www.acrossecurity.com/papers/session_fixation.pdf
http://www.webappsec.org/projects/threat/classes/session_fixation.shtml
30.03.2007 discovery of the vulnerabilities
02.04.2007 contacted the vendor
07.04.2007 advisory is written
07.04.2007 advisory released
MajorSecurity is a non-profit German penetration testing and security research project
which consists of only one person at the present time.
http://www.majorsecurity.de/