{"id":6854,"date":"2017-03-03T14:19:22","date_gmt":"2017-03-03T22:19:22","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/03\/03\/news-645\/"},"modified":"2017-03-03T14:19:22","modified_gmt":"2017-03-03T22:19:22","slug":"news-645","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/03\/03\/news-645\/","title":{"rendered":"SSD Advisory \u2013 MuraCMS Multiple Vulnerabilities"},"content":{"rendered":"

Credit to Author: Maor Schwartz| Date: Fri, 03 Mar 2017 16:04:16 +0000<\/strong><\/p>\n

\n

Vulnerabilities Summary<\/strong>
The following advisory describes two (2) vulnerabilities found in MuraCMS version 6.2. MuraCMS is an open source content management system for CFML, created by Blue River Interactive Group. Mura has been designed to be used by marketing departments, web designers and developers.<\/p>\n

The vulnerabilities found in MuraCMS are:<\/p>\n

    \n
  1. Unauthenticated remote arbitrary code execution<\/li>\n
  2. Unrestricted file upload<\/li>\n<\/ol>\n

    Credit<\/strong>
    An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

    Vendor response<\/strong>
    BlurRiver has released patch to address the vulnerabilities: “we put builds with the vulnerabilities patched and then released a blog as well as communicated via our Google group, Slack channel, twitter and mailing list.”<\/p>\n

    The patch and blog post can be found here<\/a><\/p>\n

    <\/span><\/p>\n

    Vulnerabilities details<\/strong><\/u><\/p>\n

    Unauthenticated remote arbitrary code execution<\/strong>
    The vulnerable function that can lead to remote arbitrary code execution is “evaluate<\/em>” and can be found in admin\/Application.cfm<\/em>. <\/p>\n

    The function “evaluate<\/em>” is evaluates dynamically its parameter (string). In this case it is used with the intent of checking the value of a http’s parameter. This parameter depends on the variable \u201c#theParam#<\/em>\u201c, that is obtained by splitting another http’s parameter, named \u201cparam<\/em>\u201d.<\/p>\n

    An Attacker can inject arbitrary code into this parameter. An example of malicious code could be \u201c1+or+eq+<a function>\u201d. So the evaluate function will evaluate the string \u201crequest.context.paramField1+or+eq+<\/a><a function>\u201d.<\/p>\n

    However, because of the splitting function (\u201clistLen<\/em>\u201d), you can inject only functions that have none or one parameter, because if a function has two or more parameters it will be splitted, and it will return a fatal error<\/p>\n

    In order to bypass this issue, an attacker can simply pass another evaluate<\/em> function, with a different http’s parameter as argument. So the malicious code will be \u201c1+or+eq+evaluate(#request.context.payload#)\u201d , having no commas, putting the malicious code inside payload.<\/p>\n

    Vulnerable code: File:\/admin\/Application.cfm Line:428<\/u>
    The code will be executed every time, even if the users isn’t logged in. Since the function that checks the user session will continue the execution of the code even if the user isn’t logged in, it will only modify the \u201clocation<\/em>\u201d.<\/p>\n<\/p>\n

    \t\t<\/p>\n

    \n
    <\/span> \t\t\t<\/p>\n
    \n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n