Thread Rating:
  • 0 Vote(s) - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
GetSimple CMS Security Vulnerabilities Notification
#1
Hello,

High-Tech Bridge Security Research Lab has discovered multiple security vulnerabilities in GetSimple CMS 3.1.2

Preview available here: https://www.htbridge.com/advisory/HTB23141

Developers can contact us by email for details: advisory (at) htbridge.com

For any questions related to this notification message - please visit our General Information & Disclosure Policy page: https://www.htbridge.com/advisory/disclo...olicy.html

Best regards,

High-Tech Bridge Security Research Lab
Reply
#2
to be fair, you should have added the info here, that the risk-level is low ;=)
|--

Das deutschsprachige GetSimple-(Unter-)Forum:   http://get-simple.info/forums/forumdisplay.php?fid=18
Reply
#3
I have already taken care of this, most of these are reflected xss that have already been disclosed by another firm.
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Reply
#4
shawn, that is good to hear, thanks!
|--

Das deutschsprachige GetSimple-(Unter-)Forum:   http://get-simple.info/forums/forumdisplay.php?fid=18
Reply
#5
Could you please provide us with information about these vulnerabilities discovered by "another firm"? A link to security patch would also be highly appreciated.
Reply
#6
oh, I guess its the same ones, it was just posted internally a while back, got confused there for a moment.

No patch yet.
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Reply
#7
Could you please let us know when security patch will be available? We don't want to disclose anything before it in order to protect the end-users.

Thanks.
Reply
#8
About half of have been fixed by 3.2, which was just released.
The rest will be fixed in 3.2.1
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Reply
#9
@htbridge

Just a question: is there any vulnerability that can be exploited by non-authenticated users?
Reply
#10
(2013-02-14, 08:46:25)shawn_a Wrote: About half of have been fixed by 3.2, which was just released.
The rest will be fixed in 3.2.1

We will appreciate if you can notify us about 3.2.1 release, so we can update the Solution field and change advisory status to "Fixed by Vendor". Thank you.

(2013-02-14, 08:53:05)Carlos Wrote: @htbridge

Just a question: is there any vulnerability that can be exploited by non-authenticated users?

Yes, all of them. However, they can be used only against the administrator.
Reply
#11
No they are all privileged and low vector
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Reply
#12
(2013-02-14, 09:11:55)htbridge Wrote:
(2013-02-14, 08:53:05)Carlos Wrote: Just a question: is there any vulnerability that can be exploited by non-authenticated users?

Yes, all of them. However, they can be used only against the administrator.

Sorry I didn't express myself well.

So I understand that those vulnerabilities can only be exploited with the intervention of a logged-in administrator.
Nice to know.
Reply
#13
So then does that mean all changes should be done locally and then uploaded to the live site? As so an actual login never takes place? Kinda defeats the point of a admin cp if that's the case. Yea nay?
Reply
#14
(2013-02-14, 21:50:49)WebDevandPhoto Wrote: So then does that mean all changes should be done locally and then uploaded to the live site? As so an actual login never takes place? Kinda defeats the point of a admin cp if that's the case. Yea nay?

It rather means: If your computer is not compromised and you do not click on dubious links while being logged into the GetSimple administration, there should be no problems.
I18N, I18N Search, I18N Gallery, I18N Special Pages - essential plugins for multi-language sites.
Reply
#15
It means do not be an idiot.
Just like when your using your bank site or any other site.

Do not click links blindly, do not click links to your own CMS admin pages.

These would be targeted attacks not drive bys.

The reason these are low, is because you have to be logged in, and we do not have persistant sessions, and we do not have multi users logged in typically, there is 1 admin user, and you only need to log in when you are editing the cms, not always.

There are things we can do to protect against these, and if i had more time or more devs it would be done.
You can see all the serious threats i fixed in 3.2 doign my own security audits, but we are still limited on resources and inheriting this codebase from chris and playing catch up for the most part.

3.2 fixes some of these due to the traversal fixes i already implemented.

We can add output filtering for all user input. Which should have been done anyway to begin with.
We can add refferer checking to all input, I think its restricted to editing pages.
We can add csrf checks to more operations
We can add a better antixss filter, martin wrote ours a very long time ago, and xss evolves alot.
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Reply
#16
Interesting, so these security risk are more or less developed around the concept of behavioral engineering. In that people do unintelligent things quite often. I'm not a security expert, but would applying a deny all allow from IP (an admin whitelist) in .htaccess for the admin files fix most of these type of exploits?
Reply
#17
Of your host is worth it's salt then you have mod sec enabled and it will stopper of these.

Bit if I want to hack you and I post a link in this forum to your gs site with a crafted URL I can inject JavaScript in your browser and steal
Your cookies or other bad things.
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Reply
#18
Amazing! yea I have mod sec enabled and would never click a link that has a huge URL like that.
thank you for explaining how the security risk works. Smile
Reply
#19
Some of these were fixed already in 3.2, the rest should be taken care of in 3.2.1.
See beta thread.
NEW: SA Admin Toolbar Plugin | View All My Plugins
- Shawn A aka Tablatronix
Reply




Users browsing this thread: 1 Guest(s)