AOH :: HP Unsorted W :: BX2760.HTM

WiKID wClient-PHP <= 3.0-2 Multiple XSS Vulnerabilities



WiKID wClient-PHP <= 3.0-2 Multiple XSS Vulnerabilities
WiKID wClient-PHP <= 3.0-2 Multiple XSS Vulnerabilities



WiKID wClient-PHP <= 3.0-2 Multiple XSS Vulnerabilities

  Name              Multiple Vulnerabilities in wClient-PHP
  Systems Affected  wClient-PHP 3.0-2 and earlier versions
  Severity          Medium
  Impact (CVSSv2)   Medium (5/10, vector: AV:N/AC:L/Au:N/C:C/I:N/A:N)
Vendor http://www.wikidsystems.com/ 
Advisory http://www.ush.it/team/ush/hack-wclient/wikid.txt 
  Author            Francesco "ascii" Ongaro (ascii AT ush DOT it)
                    Antonio "s4tan" Parata (s4tan AT ush DOT it)
  Date              20080411

I. BACKGROUND

 From the WiKID website: "The WiKID Strong Authentication System is a
dual-source, software-based two-factor authentication system designed
to be less expensive and more extensible than hardware tokens."

II. DESCRIPTION

In the wClient-PHP package PHP_SELF is echoed back to the client
without proper sanitization leading to XSS issues.

WiKID mantainers have released a new version of the software (3.0-3)
that fixes exposed vulnerabilities and can be downloaded from the url:

http://www.wikidsystems.com/downloads/network-clients 

Users that based their implementations on the code contained in
sample.php are advised to upgrade.

III. ANALYSIS

During a review of the wClient-PHP-3.0-1.tar.gz package (an additional
component of WiKID with network client functions) the following
vulnerabilities were identified in the sample code:

file sample.php, line 251: PHP_SELF insecure usage leads to XSS

file sample.php, line 269: PHP_SELF insecure usage leads to XSS file sample.php, line 279: PHP_SELF insecure usage leads to XSS file sample.php, line 292: possible PHP_SELF insecure usage leads to XSS This one was not verified since it's not enabled in the version I have downloaded but probably it's exploitable in the exact same way as the other ones. file sample.php, line 306: PHP_SELF insecure usage leads to XSS $PHP_SELF can be exploited by requesting an URL like file.php/. Note: On recent PHP versions $PHP_SELF should be $_SERVER['PHP_SELF']. In case of register_globals=On on recent versions where the variable is undefined it's possible to override it by issuing PHP_SELF with the wished value in GPC (GET, POST, COOKIE). On old version of PHP it's possible to drive the value of PHP_SELF by GLOBALS poisoning [1]. Version 3.0-2 fix $PHP_SELF instances to $_SERVER['PHP_SELF'], users are strongly advised to do not use this version as it doesn't correctly fix presented vulnerabilities and is more exploitable than 3.0-1. An attacker can steal UserID, Passcode, Domain code and Registration code before they are sent back to the server itself and potentially poison the navigation of the user and steal other sensitive informations via social engineering (injecting additional fields in the form or showing "additional functions" to the user) abusing user's trust. Remediation consists in proper escaping the user controlled inputs. [1] http://www.ush.it/2006/01/25/php5-globals-vulnerability/ VII. CVE INFORMATION No CVE at this time. VIII. DISCLOSURE TIMELINE 20080320 Bug discovered 20080320 Vendor contacted 20080411 Advisory released IX. CREDIT Francesco "ascii" Ongaro and Antonio "s4tan" Parata are credited with the discovery of this vulnerability. Francesco "ascii" Ongaro web site: http://www.ush.it/ mail: ascii AT ush DOT it Antonio "s4tan" Parata web site: http://www.ictsc.it/ mail: s4tan AT ictsc DOT it, s4tan AT ush DOT it X. LEGAL NOTICES Copyright (c) 2008 Francesco "ascii" Ongaro Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without mine express written consent. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email me for permission. Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information.

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.