2013-011: HTTP Response Splitting Vulnerability in WebCollab <= v3.30

Original release date: March 21st, 2013
Last revised: March 21st, 2013
Discovered by: Manuel García Cardenas
Severity: 5/10 (CVSS Base Score)
CVE-ID: CVE-2013-2652

BACKGROUND

WebCollab is a collaborative Web site for project workgroups. It aims to be easy and intuitive to use without being complicated or graphically intensive.

It uses a MySQL/PostgreSQL database backend coupled with PHP scripting and the Apache webserver.

The last version of WebCollab is 3.30 (Aotuhia) released on February 2013.

DESCRIPTION

An open redirect is a vulnerability that occurs when an application that takes a parameter and redirects a user to the parameter value without any validation.

This vulnerability is used for phishing attacks for redirecting users to visit malicious sites against their will.

Although Google shows an alert message to notify users if a redirection is generated, it is possible to create a malicious URL that avoids these alert messages.

Google is affected by this vulnerability in the images search functionality.

PROOF OF CONCEPT 

Malicious Request:

http://vulnerablesite.com/webcollab/help/help_language.php?item=%0d%0a%20FakeHeader%3a%20WriteYourOwnHeader&lang=en&type=help

   Server Response:

           HTTP/1.1 302 Found
           Server: Apache/2.4.3 (Win32) OpenSSL/1.0.1c PHP/5.4.7
           Location: http://vulnerablesite.com/webcollab/help/en_help.php#
           FakeHeader: WriteYourOwnHeader
           Content-Length: 0
           Content-Type: text/html        


BUSINESS IMPACT

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and influence or misrepresent how web content is served, cached, or interpreted. Other attacks are also possible.

SYSTEMS AFFECTED

WebCollab <= v3.30

SOLUTION

All data received by the application and can be modified by the user, before making any kind of transaction with them must be validated.

  Validate the parameter "item" on the page "/help/help_language.php" line 34:

      $help_item = $_GET['item'];

      switch($_GET['type'] ) {
      case 'admin':
      header('Location:
      '.BASE_URL.'help/'.$lang_prefix.'_help_admin.php#'.$help_item );
      break;

      case 'help':
      default:
      header('Location:
      '.BASE_URL.'help/'.$lang_prefix.'_help.php#'.$help_item );
      break;  

REVISION HISTORY

March 21, 2013: Initial release.

DISCLOSURE TIMELINE

  • March 21, 2013: Vulnerability acquired by Internet Security Auditors (www.isecauditors.com).
  • March 22, 2013: CVE-ID requested and received.
  • October 17, 2013: First contact with the developer. We send pre-advisory.
  • October 18, 2013: Developer team release a new version.
  • October 24, 2013: Advisory Release.

REFERENCES

LEGAL NOTICES

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.

ABOUT

Internet Security Auditors is a Spain and Colombia based company leader in web application testing, network security, penetration testing, security compliance implementation and assessing. Our clients include some of the largest companies in areas such as finance, telecommunications, insurance, ITC, etc. We are vendor independent provider with a deep expertise since 2001. Our efforts in R&D include vulnerability research, open security project collaboration and whitepapers, presentations and security events participation and promotion. For further information regarding our security services, contact us.