Multiple Stored/Persistent and Reflected Cross site Scripting attacks

[a0xnirudh]

This is the complete list of Stored and Reflected XSS in both Downloaded version from official site, that is, 0.9.2 and on the github branch 0.9-dev. These are not patched in any of the versions:

1. Stored/Persistent XSS:

Locations:

Creating pages: title = list"onmouseover="alert(1)";

User-Profile: Realname = Administrator"onmouseover="alert(1)";
Username field = Administrator"onmouseover="alert(1)";

New User: Realname = newuser"onmouseover="alert(1)";
username = newuser"onmouseover="alert(1)";

Extend: site page types: Name = newpage"onmouseover="alert(1)";
Custom Fields: Label = newpage"onmouseover="alert(1)";

2. Reflected XSS:

Locations:

Inside the post: <script>alert(1);</script>

(even through this may not be used to exploit, its better to fix it).

Direct URL Injection:

http://localhost/anchor-cms/admin/posts/%3Cscript%3Ealert%281%29%3C/script%3E
http://localhost/anchor-cms/admin/%3Cscript%3Ealert%281%29%3C/script%3E

I have verified the Reflected attacks by trying out the same on http://blog.anchorcms.com and brennytizer.com.au. ( @TheBrenny Just to verify).

Thanks @seshagiriprabhu for helping me with the same.

[TheBrenny]

Are these vulnerabilities used by an attacker, or only available for
creation by the admin?

The reason I'm asking this and not panicking about trying to fix the holes
is because perhaps the admin could utilise this to their advantage.
On 25 Jun 2015 19:30, "Anirudh Anand" notifications@github.com wrote:

This is the complete list of Stored and DOM based XSS in both Downloaded
version from official site, that is, 0.9.2 and on the github branch
0.9-dev. These are not patched in any of the versions:

1. Stored/Persistent XSS:

Locations:

Creating pages: title = list"onmouseover="alert(1)";

User-Profile: Realname = Administrator"onmouseover="alert(1)";
Username field = Administrator"onmouseover="alert(1)";

New User: Realname = newuser"onmouseover="alert(1)";
username = newuser"onmouseover="alert(1)";

Extend: site page types: Name = newpage"onmouseover="alert(1)";
Custom Fields: Label = newpage"onmouseover="alert(1)";

2. DOM Based XSS:

Locations:

Inside the post:

(even through this may not be used to exploit, its better to fix it).

Direct URL Injection:

The entire /admin/ area is vulnerable to DOM Based XSS attacks

http://localhost/anchor-cms/admin/posts/%3Cscript%3Ealert%281%29%3C/script%3E
http://localhost/anchor-cms/admin/%3Cscript%3Ealert%281%29%3C/script%3E

I have verified the DOM based attacks by trying out the same on
http://blog.anchorcms.com and brennytizer.com.au. ( @TheBrenny
https://github.com/TheBrenny Just to verify).

Thanks @seshagiriprabhu https://github.com/seshagiriprabhu for helping
me with the same.

—
Reply to this email directly or view it on GitHub
#876.

[a0xnirudh]

Well, the stored XSS part can be mainly used by admin but a normal user can make use of the User profile /username field to steal admin cookies if he wants too.

The Reflected XSS can be used by anyone on the internet to steal cookies or redirect the users to attacker sites !

[TheBrenny]

Ahh, I see. So if the user inserts a script on registration to steal all
cookies and then email, the user can admin their self?

I still don't understand this. I need a demonstration on how this can be
carried out.

I have Skype, and am available to be contacted via [deleted].
On 25 Jun 2015 20:44, "Anirudh Anand" notifications@github.com wrote:

Well, the stored XSS part can be mainly used by admin but a normal user
can make use of the User profile /username field to steal admin cookies if
he wants too.

The DOM Based XSS can be used by anyone on the internet to steal cookies
or redirect the users to attacker sites !

—
Reply to this email directly or view it on GitHub
#876 (comment)
.

[a0xnirudh]

@TheBrenny Can you fix this ? Just make all the user input to go through the PHP function htmlspecialchars() and it will automatically take care of the stored XSS issue.

[TheBrenny]

I'll try smash it out later. I'll make pretty much everything go through filter sanitize to take out special characters and such. Shouldn't be too hard...

[CraigChilds94]

It'd be a great help if you can do this @TheBrenny.

@TheBrenny can you send me a private message on https://gitter.im/anchorcms/anchor-cms at some point? cheers man!

[TheBrenny]

@a0xnirudh Are you sure the Direct URL injection works? I just tried in my admin panel, and it didn't work...

[a0xnirudh]

@TheBrenny Ofcourse I am. Here is a link for you to try out:

http://brennytizer.com.au/index.php/admin/login/%3Cscript%3Ealert%281%29;%3C/script%3E

You should use Firefox and not chrome since chrome has an inbuilt XSS Auditor which blocks the URL injection.

[a0xnirudh]

@CraigChilds94 was the issue #106 fixed in the Anchor CMS before ? If so can you point me to the commit that does the fix (the issue is marked as fixed, which means it has to be fixed at some point) ?

No commit has been reference in the issue #106 before closing it and I tried searching but it was quite hard to find. I think the same Stored XSS issue that I has reported were reported before in #106 and if it is resolved, then I would like to see how it got resolved and again stored XSS came at the same spot (if I can know that, I can help in fixing the same).

cc @rwarasaurus @TheBrenny

[CraigChilds94]

I'm not sure when/how it was fixed @rwarasaurus is probably best for this one, though it was years ago!

[TheBrenny]

This can be closed: #883

[mounty1]

@a0xnirudh (comment dated 25 Jun 2015)

http://localhost/anchor-cms/admin/posts/%3Cscript%3Ealert%281%29%3C/script%3E

http://localhost/anchor-cms/admin/%3Cscript%3Ealert%281%29%3C/script%3E

Those are also reflected exploitations; not DOM-based. The URLs are sent to anchor-cms, which sends them back in the 404 page.

[a0xnirudh]

@mounty1 Yes, its my mistake, it was not DOM based but Reflected ! I will modify it !