|
|
SEC Consult Security Advisory < 20091217-0 >
========================================================================= title: Authentication bypass and file manipulation in
Sitecore Staging Module
products: Sitecore Staging Module
vulnerable version: Sitecore Staging Module <= 5.4.0 rev.080625
fixed version: Staging 5.4.0 rev.091111
impact: critical
homepage:
http://www.sitecore.net/en/Products/Sitecore-CMS.aspx
found: 2009-09-07
by: L. Weichselbaum / SEC Consult / www.sec-consult.com
=========================================================================
Vendor description:
-------------------
Sitecore CMS makes it effortless to create content and experience rich
websites that help you achieve your business goals such as increasing
sales and search engine visibility, while being straight-forward to
integrate and administer. Sitecore lets you deliver sites that are
highly scalable, robust and secure. Whether you're focused on
marketing, development and design, or providing site content, Sitecore
delivers for you.
The main purpose of the Sitecore Staging module is to update two or
more Sitecore installations across a firewall.
source: http://www.sitecore.net/en/Products.aspx
http://sdn.sitecore.net/upload/sdn5/sitecore6modules/staging/
staging-module-installation-and-configuration-guide.pdf
Vulnerability overview/description:
-----------------------------------
The Staging Webservice (normally found in "/sitecore modules/staging/
service/api.asmx") used for transmitting files between the Sitecore
Master and Slave Server is vulnerable to authentication bypass and
therefore
* files can be uploaded in arbitrary directories on the server
* files can be downloaded from arbitrary directories on the server
* directory listings of the whole server can be received
* the webserver cache can be deleted
An attacker is able to upload a shell, modify or delete sensitive data
or gain the whole source code of the application. Furthermore it is
possible to retrieve directory listings of directories of the whole
server and the webroot. All these actions are performed with the rights
of the webserver user. One tested server allowed us to compromise the
whole server by uploading a shell into the webroot.
Proof of concept:
-----------------
Authentication bypass and file manipulation
==========================================To exploit this vulnerability, the example of "api.asmx?op=Upload" can
be used in a slightly modified form. The parameters "Username" and
"Password" can be set at random, but they must not be empty. The
parameter "File" contains the base64 encoded content of the file which
should be uploaded. For the parameters "append" and "isEncrypted" the
value "false" is most suitable. In "Destination" the location of the
file on the remote system can be specified. The following POST-request
creates a file named test.txt in C:\temp. It would also be possible to
upload a shell into the Webroot.
POST /sitecore%20modules/staging/service/api.asmx HTTP/1.1
Host: hostToExploit
Content-Type: application/soap+xml; charset=utf-8
Content-Length: 599