Exploit-DB #10002
Description: CuteNews and UTF-8 CuteNews - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-11-10
Author: Andrew Horton

Exploit:
MorningStar Security - Advisory
http://www.morningstarsecurity.com/

Multiple security issues in Cute News and UTF-8 Cute News


1. Advisory Information
------------------------------------------------------------------------------------------------------------------------
Title: Multiple security issues in Cute News and UTF-8 Cute News
Advisory ID: MORNINGSTAR-2009-02
Advisory URL: http://www.morningstarsecurity.com/advisories/
Release Type: Co-ordinated, responsible disclosure


2. Vulnerability Information
------------------------------------------------------------------------------------------------------------------------
Class: Cross Site Request Forgery, Cross Site Scripting, File Path Disclosure, Local File Inclusion, Authentication Bypass and PHP Command Injection
Remotely Exploitable: Yes
Locally Exploitable: No


3. Vulnerability Description
------------------------------------------------------------------------------------------------------------------------
Cute News is a powerful and easy to use news management system that uses flat files to store its database. It supports commenting, archives, search function, file upload management, backup & restore, IP banning, flood protection and more. It's available for free from http://www.cutephp.com/. Cute News is at the time of writing, the second most popular script on www.hotscripts.com. UTF-8 CuteNews is a current fork of the Cute News project which is designed to improve security and is available for free from http://korn19.ch/coding/utf8-cutenews/

Multiple vulnerabilities exist in Cute News and UTF-8 CuteNews. These vulnerabilities can be exploited to steal user credentials, disclose file contents, disclose the file path of the application and execute arbitrary commands.

Cute News appears to be abandoned since September 2008. A local file inclusion (LFI) vulnerability was discovered by athos on January 9th, 2009 for which no patch has been made.


4. Vulnerable Packages
------------------------------------------------------------------------------------------------------------------------
Cute News 1.4.6 and Cute News UTF-8 are vulnerable. Earlier versions might be effected.


5. Non-vulnerable Packages
------------------------------------------------------------------------------------------------------------------------
Cute News UTF-8b.


6. Vendor Information, Solutions and Workarounds
------------------------------------------------------------------------------------------------------------------------
Upgrade to Cute News UTF-8 version 8b.
Lucas Jacques, the maintaner of Cute News UTF-8 was very helpful.


7. Credits
------------------------------------------------------------------------------------------------------------------------
These vulnerabilities were discovered and researched by Andrew Horton (urbanadventurer) from MorningStar Security.


8. Technical Description / Proof of Concept
------------------------------------------------------------------------------------------------------------------------

8.1 Introduction

Many past advisories have been published for Cute News. An unpatched LFI exploit was published in January 2009.

Attackers without a registered account or with a comment level account can exploit cross site scripting (XSS) to steal cookies from other users, cross site request forgery (CSRF) vulnerability to execute administrator functions including adding a new administrator account and can exploit a file path disclosure vulnerability.

Attackers with an administrator account, possibly gained by using the exploits described above can exploit local file inclusion and command execution vulnerabilities to execute arbitrary commands. Journalist and Editor level accounts can edit any article. Administrator and editor level accounts can also exploit a partial file disclosure vulnerability to view all usernames.

Cute News suffers from other security failures such as:

* User registration, in register.php the password input field should be shown as stars to prevent shoulder surfing. This is fixed in UTF-8b.

* Email addresses are exposed by the news article template. The email address should be obsfucated to prevent spam harvesting. There is an option in both 1.4.6 and UTF-8b versions to hide the email address.

* Insecure cookie handling and session handling. Users are authenticated with each request by the username and password hash in the cookie. So the password is not known to authenticate.
Eg. Cookie: username=user2; md5_[CREDENTIAL_REDACTED]
In the UTF-8 fork the password cookie is salted with a prefix of 'FqZm$()G_~<' and a suffix of the users remote IP address. It is worth noting that an XSS attack will capture this cookie, and that the password can be cracked with John the Ripper using a custom rule because both the prefix and suffix will be known to the attacker.


A XSS bug was reported by DeltahackingTEAM on 2008-11-07 which I am unable to reproduce. The details are:
Exploit: http://www.example.com/register.php?config_skin=../../../../etc/passwd%00
Link: https://www.securityfocus.com/bid/32142/info

UTF-8 Cute News has not been reviewed except to check whether if it is effected by vulnerabilities found in Cute News 1.4.6.


8.2 Reflected Cross Site Scripting in index.php
------------------------------------------------------------------------------------------------------------------------
Severity: 	Medium
Requires: 	Register globals to be on
			The victim user must be logged out
			Magic quotes must be off

8.2.1 Proof of concept exploit

http://test/cutenews/index.php?lastusername='%3E%3Cscript%3Ealert(/xss/);%3C/script%3E

8.2.2 Vulnerable packages

1.4.6

8.2.3 Non-Vulnerable packages

UTF-8, UTF-8b


8.3 Reflected Cross Site Scripting in index.php
-----------------------------------------------------------------------------------------------------------------