----------------------
| ECHU.ORG Alert # 5 |
----------------------
PROGRAM : Free-BB
VULNERABLE VERSIONS : forum and goldbook's current version
IMMUNE VERSIONS : none
SEVERITY : high
Tested version
==============
Current version of the goldbook and forum.
Description
===========
Free-BB is a french provider of services to webmasters. They propose
to every webmasters to create their own goldbook or forum freely and
without any ads. The service has been launched in december 2003 and
have hundreds of users.
Issue
=====
Problems come from files Free-BB use for its forums and guestbooks.
These files contain XSS holes, an attacker can execute code since
[couleur=codecolor]text[/couleur] and [img]URL of picture[/img] have
no filters.
A badly disposed member can post a message containing code really
easily in all the forums and guestbooks created by the Free-BB service.
Details
=======
Free-BB isn't filtering ;<>*()"'] caracters. Here is an example with
the file module-livredor.php (line 42) :
$coment=preg_replace("/(\[couleur=(.*?)\])(.*?)(\[\/couleur\]
)/i", "<span style=\"color:\\2\">\\3</span>", $coment);
Here the correct code should be :
$coment=preg_replace("/(\[couleur=([#a-zA-Z0-9]*)\])(.*?)(\[\/couleur\]
)/i", "<span style=\"color:\\2\">\\3</span>", $coment);
P-o-C
=====
These two proof-of-concept will show a window that can freeze your
computer if using Internet Explorer so take care :
- [couleur=expression(alert('unsecure'))]texte[/couleur]
- [img]javascript:alert('unsecure')[/img]
Solution
========
Free-BB has been contacted, and a patch has been released two weeks
later.
Links
=====
Free-BB : http://www.free-bb.com/
Free-BB Goldbooks : http://livredor.free-bb.com/
This vulnerability's orginal paper can be found here :
http://www.echu.org/articles/alertes/echu-alert5.txt
------------------------------
David Suzanne (dAs)
das[a]echu.org
http://www.echu.org
-----------------------------------------------------------------
ECHU.ORG is not responsible for the misuse of the information we
provide through our security advisories. These advisories are a
service to the professional security community. In no event shall
ECHU.ORG be liable for any consequences whatsoever arising out of
or in connection with the use or spread of this information.
-----------------------------------------------------------------
This archive was generated by hypermail 2b30 : Sun Feb 29 2004 - 08:40:24 PST