XSS and open redirect on login form, CVE-2018-1000671

[hmpf]

The following link redirects to bing:

https://listes.renater.fr/sympa?referer=https://www.bing.com&passwd=&previous_action=&action=login&action_login=&previous_list=&list=&email=

It also works in 6.2.16. We have no newer sympa to test with.

It seems to me maybe this is a bug in a perl dependency? I couldn't find "referer" directly in sympa's source code during a (very) cursory grep.

[ikedas]

Hi @hmpf,

It is a feature. But I agree it may be used to confuse users. I think this feature woould be better to be removed in the future.

[lightsey]

This is an open redirect vulnerability.
https://cwe.mitre.org/data/definitions/601.html

You can also use data URI payloads here for a more traditional reflected XSS.
https://listes.renater.fr/sympa?referer=data%3Atext%2Fhtml%3Bbase64%2CPHNjcmlwdD5hbGVydCgiSGVsbG8iKTs8L3NjcmlwdD4%3D&passwd=&previous_action=&action=login&action_login=&previous_list=&list=&email=

[lightsey]

I submitted this to the DWF for CVE assignment since the issue is publicly visible.

[lightsey]

This issue was assigned CVE-2018-1000671

[ikedas]

Hi @lightsey,

Could you please forward assignment information (JSON data) to <sympa-security@listes.renater.fr>? Information have never been publicly disclosed and security team might want to investigate it.

[racke]

Here is the corresponding Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908165

[ikedas]

Hi all,

Here is minimal fix (hopefully): c6ce32a Please check it.

• Note that it may close XSS but won't close general open redirect initially pointed out by @hmpf so that a feature of Sympa will work. See my comment below.

[ikedas]

CVE-2018-1000671 says "sympa version 6.2.16 and later" affect. However, looking archived branches, "referer" parameter has not been sanitized from the beginning. The statement should be corrected to be "all versions of Sympa".

[lightsey]

I'm not sure why NVD is showing "6.2.16 and later". The data I submitted and the DWF approved was "4.0a5 and later" which looked to me like the first version tag that contained the open redirect. I'll email Kurt and ask if he can get it corrected in the main CVE list.

[ikedas]

With PR above, referer (and failure_referer) parameters will be allowed only when they are included in the scope of cookie domain (sufficient for session sharing feature) and redirection to "unauthorized" domains will be avoided.

If this may solve the problem described in the CVE, I'll merge it.

[ikedas]

Merged. Thanks for reporting & suggesting.