The Joomla! Forum ™



Forum rules


Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 42 posts ]  Go to page 1, 2  Next
Author Message
PostPosted: Sun Oct 14, 2007 9:41 am 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Thu Jun 01, 2006 9:28 am
Posts: 769
Location: Scotland
Just found this on National Vulnerability Database, posted on 12th Oct 2007.

Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter.

Link to notice - http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5427

Listed on Security Focus with a little more information http://www.securityfocus.com/bid/26031/info

Also listed on various hacking sites.

Any advice on what to do to prevent this?

_________________
Geo

http://www.dalserf.org
http://www.improveyoursnooker.net


Top
 Profile  
 
PostPosted: Sun Oct 14, 2007 9:51 am 
User avatar
Joomla! Master
Joomla! Master
Offline

Joined: Thu Aug 18, 2005 10:41 am
Posts: 15729
Core / Developers are already aware of this and working on it. It's actually not a real XSS issue, as you are only able to cause a javascript popup. You are also limited to 20 characters and only to the search component, not to the rest of the CMS.

As I said, it's being worked on right now, and it will at least be fixed in SVN.

_________________
Regards Robin

http://www.linkedin.com/in/robinmuilwijk - http://twitter.com/i_robin


Top
 Profile  
 
PostPosted: Fri Dec 21, 2007 7:40 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
Is there a way to monitor the status of this fix?

Thanks,
KP


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 5:13 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 1105
Location: Weymouth, UK
RobInk wrote:
Core / Developers are already aware of this and working on it. It's actually not a real XSS issue, as you are only able to cause a javascript popup. You are also limited to 20 characters and only to the search component, not to the rest of the CMS.

As I said, it's being worked on right now, and it will at least be fixed in SVN.


That is possibly one of the most misleading replies I have ever read from someone in a position of authority in Joomla.

1) by definition this is a XSS issue! Being able to generate a popup is an XSS issue.
2) Just cause its limited to 20 chars doesn't mean its not a problem - actually I created a proof of concept where I was able to steal the cookie using this exploit!!!!!
3) This is not fixed in SVN, you posted on 14th October and No changes have been made since then until last night for another exploit fix.

_________________
Phil Taylor - Full Time Joomla/PHP Expert
Blue Flame IT Ltd.
-- http://fix.myjoomla.com/ Same day commercial fixes for Joomla sites worldwide
-- http://www.phil-taylor.com/


Last edited by PhilTaylor-Prazgod on Thu Jan 03, 2008 5:15 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 5:19 pm 
I've been banned!
Offline

Joined: Wed Jan 02, 2008 9:52 am
Posts: 35
PhilTaylor-Prazgod wrote:
RobInk wrote:
Core / Developers are already aware of this and working on it. It\'s actually not a real XSS issue, as you are only able to cause a javascript popup. You are also limited to 20 characters and only to the search component, not to the rest of the CMS.

As I said, it\'s being worked on right now, and it will at least be fixed in SVN.


That is possibly one of the most misleading replies I have ever read from someone in a position of authority in Joomla.

1) by definition this is a XSS issue! Being able to generate a popup is an XSS issue.
2) Just cause its limited to 20 chars doesn\'t mean its not a problem - actually I created a proof of concept where I was able to steal the cookie using this exploit!!!!!
3) This is not fixed in SVN, you posted on 14th October and No changes have been made since then until last night for another exploit fix.



Phil, I\'m sure you love to help, but you are fixing to be banned.

around here, nobody likes somebody who is wiseass or,  simply, wise.


try to be a bit more *blond* and all should go well


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 5:25 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 1105
Location: Weymouth, UK
I'm amazed by your post - simply amazed.

I refuse to be quiet about security issues.

If I get banned for being a pain in the rear regarding security issues then so be it.

I am not trying to be a wiseass, but I do have a hell of a lot of experience in this and a previous CMS project that I bring to each post.

Factually incorrect and misleading posts (especially about security) should be corrected when found.

I stand by my post.

_________________
Phil Taylor - Full Time Joomla/PHP Expert
Blue Flame IT Ltd.
-- http://fix.myjoomla.com/ Same day commercial fixes for Joomla sites worldwide
-- http://www.phil-taylor.com/


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 5:25 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Fri Mar 03, 2006 3:26 pm
Posts: 545
Location: Canuck via MKE
@cariboo: big words for a "New Member". Is your promotion to moderator pending?

_________________
Victor Drover - Curator, Joomla Extensions Directory
http://anything-digital.com
The home of JCal Pro (the Joomla event calendar) and sh404SEF - SEO & security for Joomla


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 5:26 pm 
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Thu Jun 01, 2006 3:16 pm
Posts: 207
Location: Texas, USA
Phil is spot on. Please refrain from issuing gag orders.

_________________
cmsconnection.com/forum - the multi-cms forum


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 5:27 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
@Cariboo
That's a little short-sighted on your part, I think.  Phil has provided some very valuable insight to problems in Joomla that no one else has bothered to address in this post.  We have around 30 Joomla-based 1.0.x sites that are LIVE and they are ALL failing our security checks, mainly because of XSS scripting.  So, if someone as experienced as Phil ( http://extensions.joomla.org/component/option,com_mtree/task,viewlink/link_id,353/Itemid,35/ ) says he can steal a cookie using an exploit that is less that 20 characters, we stand up and take notice.  If it bothers you he is posting his useful information, then I recommend you just ignore it.  Some of us out here depend on that kind of information.  Grow up for crying out loud.


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 5:32 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Mon Oct 03, 2005 2:51 pm
Posts: 155
Location: Singapore
cariboo wrote:


Phil, I\'m sure you love to help, but you are fixing to be banned.

around here, nobody likes somebody who is wiseass or,  simply, wise.





I need to type in large and bold letters I don't know why ZOMG!

_________________
-----
Making social sites functional: http://www.simbunch.com/
http://twitter.com/simbunch


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 6:41 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 1105
Location: Weymouth, UK
Probably the reason this has not been fixed quickly is because the root cause of the problem is the way that page navigation class is used to create limit drop down box. The pageNav class is different for the frontend and the admin side.

That attached file diff fixes this issue on Joomla 1.0.13

The diff will add a new function to your frontend pageNav class (duplicate of the method in admin) and then tweak your com_search to use that new method instead.

Nothing fancy or pretty, infact its ugly but works.

Tested and working - also nukes the current XSS in com_search as no longer is the searchword passed around into javascript strings in onchange commands.

now smile!


You do not have the required permissions to view the files attached to this post.

_________________
Phil Taylor - Full Time Joomla/PHP Expert
Blue Flame IT Ltd.
-- http://fix.myjoomla.com/ Same day commercial fixes for Joomla sites worldwide
-- http://www.phil-taylor.com/


Last edited by PhilTaylor-Prazgod on Thu Jan 03, 2008 6:43 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 6:51 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
Awesome, Phil!  Thanks.  I will test it out ASAP.  Not bad for a "WiseAss"!  (hehe, just kidding)


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 7:04 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Fri Mar 03, 2006 3:26 pm
Posts: 545
Location: Canuck via MKE
cheers.

_________________
Victor Drover - Curator, Joomla Extensions Directory
http://anything-digital.com
The home of JCal Pro (the Joomla event calendar) and sh404SEF - SEO & security for Joomla


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 7:12 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
Phil, I sent you a private msg, so please ignore that.  I will just ask my question here.....

Our security scans reported problems with XSS exploits using other com objects.  Would your fix correct the
problems in com_content, for instance?  How about a URL like "index.php?fontstyle=f-smaller....... ??  (I can provide a specific example in private if you need it)

Thanks again,
Kepper


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 7:16 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 1105
Location: Weymouth, UK
kepper wrote:
Phil, I sent you a private msg, so please ignore that.  I will just ask my question here.....

Our security scans reported problems with XSS exploits using other com objects.  Would your fix correct the
problems in com_content, for instance?  How about a URL like "index.php?fontstyle=f-smaller....... ??  (I can provide a specific example in private if you need it)

Thanks again,
Kepper



No - this diff file is specific to the XSS reported in the com_search component and will not fix any other XSS (If they exist)

If you would like to forward a proof of concept for any other type of XSS in core components I will happy to take a look

_________________
Phil Taylor - Full Time Joomla/PHP Expert
Blue Flame IT Ltd.
-- http://fix.myjoomla.com/ Same day commercial fixes for Joomla sites worldwide
-- http://www.phil-taylor.com/


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 7:18 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
Actually, I will e-mail it to you... I just realized we could do that.  I'm not much of a bulletin boarder.. sorry.

-Kepper



Ok.. I have a list.  I will send to you in private.  It is detailed and we don't want anyone to get any ideas from the report.

Keep a lookout in your private inbox.

Thanks,
Kepper


Last edited by kepper on Thu Jan 03, 2008 7:19 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 7:37 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 26, 2005 1:31 am
Posts: 1347
Thanks for you work Phil!  :)

_________________
Follow me on Twitter @compassdesign
www.compassdesigns.net - Get get free templates and news for Joomla
simplweb.com/joomla-hosting - Fully Managed Joomla Hosting - Unlimited Support


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 7:48 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Tue Apr 11, 2006 7:29 pm
Posts: 738
Will there be an official fix coming out soon, or should we implement this fix?

_________________
http://www.dart-creations.com - We make Joomla Easy: Tutorials, Tips and Tricks, Lots of Free Modules incl. Featured Articles, Popin Window, Visitors Map, Random Flash, Slide Menu (dropdown), 2CO / Paypal payment, YouTube module, and more!


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 8:27 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Sat Aug 20, 2005 12:32 pm
Posts: 1105
Location: Weymouth, UK
dattard wrote:
Will there be an official fix coming out soon, or should we implement this fix?


I cannot say that there will or will not be an official fix coming - all I know is my fix , fixes the reported XSS in com_search.

Youa re free to implement my suggested changes.

_________________
Phil Taylor - Full Time Joomla/PHP Expert
Blue Flame IT Ltd.
-- http://fix.myjoomla.com/ Same day commercial fixes for Joomla sites worldwide
-- http://www.phil-taylor.com/


Top
 Profile  
 
PostPosted: Thu Jan 03, 2008 10:10 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1916
Location: Toowoomba, Australia
It's being looked into.  However it would *really* help out for people writing patches to also log a tracker item with the patch and if it's a security problem raise it with the highest priority.  Post here if you like but also do it in the tracker please (if you are mailing me directly with a "key look at this", please make sure you are pointing me to the tracker entry and that can point back to the forum as a reference).  That will help us a lot.

Also, for the old-timers around, if you see critical issues that are not resolved in the forum, check to see if they are in the tracker, and if they aren't it would be a great help if you could raise it for us.  Thanks in advance.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://learn.theartofjoomla.com - Joomla 1.6 training videos!
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.


Top
 Profile  
 
PostPosted: Fri Jan 04, 2008 12:48 am 
I've been banned!
Offline

Joined: Wed Jan 02, 2008 9:52 am
Posts: 35
vdrover wrote:
@cariboo: big words for a "New Member". Is your promotion to moderator pending?


??? Why WOULDNT it be?

I figure I can CUT AND PASTE vaguely relevant and almost responsive snippets from the FAQS  (to your *Ive just been hacked!* posts ) just as well as any of them!

:)


Top
 Profile  
 
PostPosted: Fri Jan 04, 2008 1:33 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1916
Location: Toowoomba, Australia
Ok guys keep it down.  Let's replace points scoring with problem fixing.  Thanks.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://learn.theartofjoomla.com - Joomla 1.6 training videos!
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.


Top
 Profile  
 
PostPosted: Fri Jan 04, 2008 5:59 am 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1916
Location: Toowoomba, Australia
Phil and others, please test the SVN copy of 1.0 and see if the exploit is still available.  Thanks.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://learn.theartofjoomla.com - Joomla 1.6 training videos!
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.


Top
 Profile  
 
PostPosted: Fri Jan 04, 2008 9:47 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
We had several XSS exploits show up in a security test of our latest Joomla 1.0.13 based website.  I sent Phil Taylor the list from the report scan.  He checked them and was unable to duplicate the problem on his end and basically called them false positives.  That led me to think it was possibly the template we were using.  Sure enough, when we switched away from the template to the default Joomla template, none of the XSS exploits manifested themselves.  We contacted our template vendor and they immediately looked into and solved our problem.  They are going to make an update available ASAP.  I don't want to mention their name only because I don't want them to receive any bad press.  They jumped on the problem and fixed it and we are happy.  If you have to know, go to some of the major Joomla theme providers (I have no idea how many there are) and check their announcements.

Bottom line:  The problem reported in this thread is not necessarily a Joomla problem.  If you are using a third party template, go back to the original and test against that.

The fix was basically to intercept the URL variables and wash them through mosGetParam().

$foo = mosGetParam( $_REQUEST, 'foo' );

Many thanks to Phil Taylor.  He took the time to help us and the Joomla community out.  We will definitely be sending business his way in the very near future.


Top
 Profile  
 
PostPosted: Fri Jan 04, 2008 9:49 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 12, 2005 2:45 am
Posts: 1916
Location: Toowoomba, Australia
Thanks kepper for the update.

_________________
Andrew Eddie - Tweet @AndrewEddie
<><
http://learn.theartofjoomla.com - Joomla 1.6 training videos!
http://www.kiva.org/team/joomla - Got Joomla for free? Pay it forward and help fight poverty.


Top
 Profile  
 
PostPosted: Sat Jan 05, 2008 5:55 pm 
User avatar
Joomla! Ace
Joomla! Ace
Offline

Joined: Fri Aug 26, 2005 1:31 am
Posts: 1347
kepper wrote:
We had several XSS exploits show up in a security test of our latest Joomla 1.0.13 based website.  I sent Phil Taylor the list from the report scan.  He checked them and was unable to duplicate the problem on his end and basically called them false positives.  That led me to think it was possibly the template we were using.  Sure enough, when we switched away from the template to the default Joomla template, none of the XSS exploits manifested themselves.  We contacted our template vendor and they immediately looked into and solved our problem.  They are going to make an update available ASAP.  I don't want to mention their name only because I don't want them to receive any bad press.  They jumped on the problem and fixed it and we are happy.  If you have to know, go to some of the major Joomla theme providers (I have no idea how many there are) and check their announcements.

Bottom line:  The problem reported in this thread is not necessarily a Joomla problem.  If you are using a third party template, go back to the original and test against that.

The fix was basically to intercept the URL variables and wash them through mosGetParam().

$foo = mosGetParam( $_REQUEST, 'foo' );

Many thanks to Phil Taylor.  He took the time to help us and the Joomla community out.  We will definitely be sending business his way in the very near future.


Could you PM me with some details of the issue regarding templates please

_________________
Follow me on Twitter @compassdesign
www.compassdesigns.net - Get get free templates and news for Joomla
simplweb.com/joomla-hosting - Fully Managed Joomla Hosting - Unlimited Support


Top
 Profile  
 
PostPosted: Mon Jan 07, 2008 1:41 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast
Offline

Joined: Sat Nov 11, 2006 5:01 am
Posts: 190
Location: Latham, NY
kepper wrote:
We had several XSS exploits show up in a security test of our latest Joomla 1.0.13 based website. 


Out of curiosity, what did you use to scan your website?


Top
 Profile  
 
PostPosted: Mon Jan 07, 2008 1:00 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
Quote:

Out of curiosity, what did you use to scan your website?




The report has a logo titled "SPI Dynamics" on it.  So, I assume that is the program used.  Another department in our corporation actually performed the scan and sent the report to us.


Top
 Profile  
 
PostPosted: Mon Jan 07, 2008 1:03 pm 
User avatar
Joomla! Apprentice
Joomla! Apprentice
Offline

Joined: Fri Jul 06, 2007 7:37 pm
Posts: 18
Quote:
Could you PM me with some details of the issue regarding templates please


@Compass: I will PM you even though you are offline.  I assume you will still get the message in your inbox.


Last edited by kepper on Mon Jan 07, 2008 1:07 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Jan 07, 2008 6:31 pm 
User avatar
Joomla! Guru
Joomla! Guru
Offline

Joined: Thu Jun 01, 2006 9:28 am
Posts: 769
Location: Scotland
kepper wrote:
Quote:

Out of curiosity, what did you use to scan your website?




The report has a logo titled "SPI Dynamics" on it.  So, I assume that is the program used.  Another department in our corporation actually performed the scan and sent the report to us.


Could it be this http://www.spidynamics.com/

_________________
Geo

http://www.dalserf.org
http://www.improveyoursnooker.net


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 42 posts ]  Go to page 1, 2  Next



Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group