---

[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] Re: [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal

---

---

-------------
 Timeline:
-------------

2009.03.05 - disclosed at link://[click]
2009.03.15 - posted to FD (link://[click])
2009.03.15 - 2010.12.20 - No one gave a fuck
2010.12.20 - MustLive announced at my site.


2010.12.21 - MustLive informed developers.


2011.02.18 - disclosed at MustLive's site.


2011.02.18 - current - Everyone continued to not give a fuck



On Mon, Feb 21, 2011 at 11:00 PM, Justin Klein Keane
<justin@xxxxxxxxxxxx> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - ------------
> Timeline:
> - ------------
>
> 2009.03.05 - disclosed at link://[click]
> 2009.03.15 - posted to FD (link://[click])
> 2010.12.20 - MustLive announced at my site.


> 2010.12.21 - MustLive informed developers.


> 2011.02.18 - disclosed at MustLive's site.


>
> Justin C. Klein Keane
> link://[click]
>
> The digital signature on this message can be confirmed
> using the public key at link://[click]
>
> On 02/19/2011 02:28 PM, MustLive wrote:
>> Hello list!
>>
>> I want to warn you about Abuse of Functionality vulnerabilities in Drupal.


>>
>> -------------------------
>> Affected products:
>> -------------------------
>>
>> Vulnerable are Drupal 6.20 and previous versions.


>>
>> ----------
>> Details:
>> ----------
>>
>> Abuse of Functionality (WASC-42):
>>
>> There is unreliable mechanism of changing password in the system. In user
>> profile (link://[click]) it's possible to change password without
>> knowing of current password. And even there is protection against CSRF in
>> the form, this will not protect against Abuse of Functionality.


>>
>> Because with using of XSS vulnerabilities it's possible to bypass this
>> protection and conduct remote attack for changing of the password (including
>> administrator's one). Or at session hijacking via XSS it's possible to get
>> into account and change the password. Or it's possible to do that at
>> temporarily access to user's computer, from which he logged in to his
>> account.


>>
>> Abuse of Functionality (WASC-42):
>>
>> Besides two before-mentioned methods (link://[click]),
>> there are the next methods for enumerating of logins of the users.


>>
>> At the forum (link://[click]) logins of the users show, which posted at
>> the forum (opened a topic or wrote a comment).


>>
>> In section Recent posts (link://[click]) at pages "All last posts" and
>> "My posts" logins of the users show, which wrote posts at the site. Attack
>> is possible to conduct only for logged in users.


>>
>> In posts of the blog (link://[click]), and also in comments to
>> blog posts and other pages of the site (link://[click]) logins of the
>> users show, which made a post in blog or made a comment.


>>
>> In password recovery form (link://[click]) it's possible on find
>> existent logins and e-mails of the users at the site. If to send incorrect
>> login or e-mail then the message shows "Sorry, ... is not recognized as a
>> user name or an e-mail address.", and if to send correct login or e-mail,
>> then this message will not show.


>>
>> ------------
>> Timeline:
>> ------------
>>
>> 2010.12.20 - announced at my site.


>> 2010.12.21 - informed developers.


>> 2011.02.18 - disclosed at my site.


>>
>> I mentioned about these vulnerabilities at my site
>> (link://[click]).


>>
>> Best wishes & regards,
>> MustLive
>> Administrator of Websecurity web site
>> link://[click]
>>
>>
>> 
>> Full-Disclosure - We believe in it.


>> Charter: link://[click]
>> Hosted and sponsored by Secunia - link://[click]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - link://[click]
>
> iPwEAQECAAYFAk1ifhMACgkQkSlsbLsN1gBIGwb/b+4L5kuSZergm1xuNle4JMeC
> itwiMfMzmFjWFJojO/+h65iKjkVyzVeZdscZHT+yIXIr0C2WpmxoVukALd184gWB
> t3XfGO0cGche3dqZOcCCMHS6thJREKwSNqilxoYV4Wizmz9C2P9OullXhudRIefp
> 7CxX/O2U7oJgAbnJNNjUGNPotee4SzFCLdwN4KHXNVrCorVIViIPDMZT2BxU6cct
> jhp8QFQ5tVXwamdhbA5s+ALnmXc4rvedjYQesrre3c9IAh0IWL/6bYtXcluTDGP7
> OJD2Yj5VjnriJSGErsM=
> =1WaJ
> -----END PGP SIGNATURE-----
>
> 
> Full-Disclosure - We believe in it.


> Charter: link://[click]
> Hosted and sponsored by Secunia - link://[click]
>


Full-Disclosure - We believe in it.


Charter: link://[click]
Hosted and sponsored by Secunia - link://[click]

---

• Suivi:
  • Re: [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal

• References:
  • [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal
  • Re: [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal

• Precedent par Date: Re: [Full-disclosure] University of Central Florida Multiple LFI / Dirty Indian rant
• Suivant par Date: Re: [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal
• Precedent par fil : Re: [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal
• Suivant par fil : Re: [Full-disclosure] Abuse of Functionality vulnerabilities in Drupal
• Index(s):
  • Date
  • Fil

---

Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure