Penetration Test Report (SecureLayer7): SecureLayer7 Pentest report Pagekit CMS

Pentest Report – Pagekit 01-2017
https://github.com/pagekit/
SecureLayer7
Index
• Intro
• Scope
• Identified Vulnerabilities
• Conclusion
Intro
“Pagekit is a modular and lightweight content management system. It gives the tools to create
websites.” - As per Pagekit website
This penetration test was carried out by Securelayer7 team. It was carried out for 4 days. The test
identified one critical vulnerability which leads to vertical/horizontal authentication bypass. It was also
found that Pagekit users swiftmailer version 5.4.1 for sending mails which has been recently hit with
remote code execution vulnerability. In addition to that, 4 minor and 1 medium vulnerabilities were
discovered that require to be addressed.
Scope
• Source code available on Github (https://github.com/pagekit/)
• Locally hosted web application
Testing environment
• Latest Kali Linux 64 bit 2016.2
• LAMP
Identified Vulnerabilities
The following sections list vulnerabilities. The findings are listed in chronological order and not by their
degree of severity. The severity is given in brackets following the title heading. Each bug is given a
unique identifier for the purpose of future reference and follow-up.
SL7_PGKT_01: Vertical/Horizontal Authentication Bypass (Critical)
Description: A vulnerable end point reveals the password reset links clicked by all the users of Pagekit.
This means whoever clicks on those links will have their accounts compromised. No privilege level is
required to see that end point. It is public. So, an unauthenticated attacker can perform complete
account takeover. Note that the password reset link also has the username mentioned in it. So, an
account takeover can be performed because the attacker knows both the password and username
(password was changed by him and the username is displayed in the reset link).
The vulnerable end point is: /pagekit/index.php/_debugbar/<the secret code here>
The ‘secret code’ is nothing but the value of debugbar in ‘<script>var $debugbar =
{"current":"60b4b0f6a3fcdf3bff05668401c2ec12c75ee152"};</script>’ js in the HTML source of the login page .
PoC:
1. Along with this report, an exploit developed in Ruby is attached.
2. Execute it using command prompt.
3. Login as any user and reset your password and click on your password reset link.
4. Go to the command prompt and observe that the executing script captures the password reset
link.
Mitigation: When login page is loaded, the long cryptographic code is revealed in client side JavaScript.
Do not disclose it there. If it is not displayed, then no one can use it to find the reset links. It is very long
so brute forcing is not possible, so this will make it safe.
SL7_PGKT_02: Server side information disclosure (Medium)
Description: The application has an endpoint that reveals following information:
• Some database queries
• Server information including computer name, PHP version, SQL server name and version
• Full path of the web application
The end point is the same as the one mentioned in SL7_PGKT_05.
PoC:
A file named informationdisclosure.json is attached with this report. Please view it.
Mitigation: The mitigation is same as that of SL7_PGKT_01.
SL7_PGKT_03: Misconfiguration .htaccess (Low)
Description: During the penetration testing we have used the LAMP to test the application and we
found that the .htaccess does not restrict users to access the file phpunit.xml.dst. It has sensitive data
such as temporary usernames and passwords of DB, SMTP and FTP. Although, the credentials are not
used by the application, but they can be used for testing purpose or in future if there is any
enhancement in the application. This is the reason, this vulnerability is reported with low severity. It can
also be treated as informational.
PoC: Request the file in browser and observe that it is publicly available
http://yourpagekitsite.com/phpunit.xml.dst
Mitigation:
1) For apache server. Please add ‘|phpunit.xml.dist’ in line 2 of .htaccess file. After this is done, any
user who requests it will get a forbidden error.
2) For Nginx server – the phpunit.xml.dist used for the internal purposes, so you can provide IP
based access to the user.
SL7_PGKT_04: Weak Password Policy (Low)
When a new user is added, the application does not enforce a password policy resulting in users created
having weak passwords. This is not a good practice. Although it is not a major vulnerability, but letting
users use weak passwords make the job of an attacker easier because the passwords are then very easy
to guess and cracked with less efforts.
PoC:
1. Login as admin and go to create new user page (link:
http://127.0.0.1/pagekit/index.php/admin/user/edit)
2. Enter valid details in all the fields
3. Enter password as test, 1234.
4. Click on SAVE
5. Observe that the application accepts it
Mitigation: Implement server side check that validate whether entered password is of min 6 characters
or not. In the following function: validate() (line number 220-260) in
pagekit/app/system/modules/user/src/models/user.php . It is also recommended to user to change the
password change password on the first login.
SL7_PGKT_05: Sensitive Information leakage via referrer header (Low)
Description: Password reset security token gets leaked to third party websites via referrer header. The
homepage has a footer section which has links to third party websites such as github, twitter. If a user
clicks on any of the links then the URL of the current page gets sent to them via referrer header and will
be seen in logs of the web server of those websites. Although you can trust those sites, but it is not a
good practice to include security tokens in referrer header while navigating to third party websites.
PoC:
GET /pagekit HTTP/1.1
Host: twitter.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer:
http://127.0.0.1/pagekit/index.php/user/resetpassword/confirm?user=saurabh&key=51mwy/ethCt2SqrTFwKarkk90MMzZkWC
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Mitigation: In order to resolve this, whenever the password reset link gets loaded have the following in
code between <head> tags of the html: <meta name="referrer" content="never" /> This will not send
referrer headers to third party websites.
SL7_PGKT_06: Plain text storage of credentials (Low)
The password for SMTP connection is stored in plain text in the database. If some other vulnerability like
SQL Injection causes the DB to be compromised, then attacker will obtain SMTP credentials.
PoC:
1. In order to reproduce this issue, set smtp settings using admin panel.
2. Go to DB and execute the following query: SELECT * FROM `pk_system_config` where name like
'%mail%'
Mitigation: Encrypt the password using a script and then store it in DB. At the time of sending email,
decrypt it and then send to the SMTP server.
SL7_PGKT_07: SWIFTMAILER Remote Code Execution (Low)
Description: Pagekit uses swiftmailer version 5.4.1 for sending mails to users. All swiftmailer versions <=
5.4.5 are vulnerable to remote code execution (CVE-2016-10074). Note that in order to exploit this
vulnerability, an attacker has to enter payload in the ‘From’ address of the mails. But the current Pagekit
application does not have any functionality that lets users do that (for e.g. contact us). But it is
recommended that swiftmailer library should be upgraded to latest patched version because there is a
chance that a contact us page can be developed by Pagekit team in the future as an enhancement.
PoC: Due to no functionality that lets user modify ‘From’ field of an email, a PoC could not be made.
Mitigation: Upgrade swiftmailer to latest patched version as soon as the vendor patches it.
Conclusion
One authentication bypass vulnerability has been found which should be the point of concern. The fact
that this can be remote exploited by