Vulnerabilities in SWFUpload in multiple web applications: WordPress, Dotclear, InstantCMS, AionWeb

Hello list!

Earlier I've wrote about Content Spoofing and Cross-Site Scripting

is very popular flash-file, which is used at tens millions of web sites and

in hundreds of web applications (only WordPress is used at more then 62

millions of web sites according to wordpress.com).

Last year I've wrote about other XSS hole in SWFUpload and I mentioned that

there are many web applications with vulnerable SWFUpload. All of them are

vulnerable to these new vulnerabilities, except swfupload.swf bundled with

WordPress since version 3.3.2.

There are different names of files of SWFUpload: swfupload.swf,

swfupload_f9.swf, swfupload_f8.swf, swfupload_f10.swf and swfupload_f11.swf.

Many web applications include few swf-files of SWFUpload. Not all of these

swf-files are vulnerable to new holes: swfupload_f8.swf and swfupload_f9.swf

are not vulnerable (they have no buttonText functionality according to my

research).

So from those web applications the next are vulnerable (plus many other web

applications):

swfupload.swf - Dotclear, XenForo, InstantCMS, AionWeb, Dolphin,

SwfUploadPanel for TYPO3 CMS, SentinelleOnAir.

swfupload_f10.swf - SwfUploadPanel for TYPO3 CMS, Archiv plugin for TinyMCE,

Liferay Portal (Community Edition and Enterprise Edition), Swfupload for

Drupal, SWFUpload for Codeigniter, SentinelleOnAir.

swfupload_f11.swf - SentinelleOnAir.

Also InfoGlue is vulnerable (about XSS vulnerability in ZeroClipboard.swf in

which I've wrote last month), because it has SWFUpload too.

-------------------------

Affected products:

Vulnerable are all web applications with SWFUpload (v2.2.0.1 and previous

versions).

Vulnerable are versions WordPress 2.7 - 3.3.1 (which bundled with

swfupload.swf). The fixed version of swfupload.swf in WP 3.3.2 contain fix

as for previous XSS, as for these CS and XSS vulnerabilities (even WP

developers didn't write about it).

Vulnerable are potentially all versions of Dotclear, InstantCMS, AionWeb,

Dolphin, SwfUploadPanel for TYPO3 CMS, Archiv plugin for TinyMCE, Liferay

Portal (Community Edition, which earlier called Standard Edition, and

Enterprise Edition), Swfupload for Drupal, SWFUpload for Codeigniter and

SentinelleOnAir. There is no information that they have fixed these

vulnerabilities in their software (at that these holes were fixed together

with another XSS hole in WordPress 3.3.2 at 20.04.2012).

Vulnerable are versions XenForo 1.0.0 - 1.1.2. In XenForo 1.1.3 this

vulnerability was fixed and patch was released for previous versions. They

used the same swf-file, as in WP 3.3.2, so it contains a fix as for previous

XSS, as for these CS and XSS vulnerabilities (even XenForo developers didn't

write about it, because they didn't know that, since WP developers did it

secretly).

-----

Fix:

Use swfupload.swf from WordPress 3.3.2 and higher versions. All web

developers need to update their vulnerable version of SWFUpload to this

fixed version.

----------

Details:

There are two vulnerabilities in SWFUpload.

Content Spoofing (WASC-12):

<a href="http://site/swfupload.swf?buttonText=test%3Cimg%20src=%27http://demo.swfupload.org/v220/images/logo.gif%27%3E">http://site/swfupload.swf?buttonText=test%3Cimg%20src=%27http://demo.swfupload.org/v220/images/logo.gif%27%3E</a>

It's possible to inject text, images and html (e.g. for link injection).

Cross-Site Scripting (WASC-08):

Code will execute after click. It's strictly social XSS.

These are examples of XSS vulnerability in different web applications:

WordPress:

Dotclear:

XenForo:

InstantCMS:

AionWeb:

Dolphin:

SwfUploadPanel for TYPO3 CMS:

Archiv plugin for TinyMCE:

Liferay Portal:

Swfupload for Drupal:

As it can be seen from the project

for Drupal. But exactly in this project there are no files. But they are in

Drupal with Swfupload.

<a href="http://site/js/libs/swfupload_f10.swf">http://site/js/libs/swfupload_f10.swf</a>

SWFUpload for Codeigniter:

SentinelleOnAir:

InfoGlue:

Previous XSS vulnerabilities:

New XSS vulnerability:

Best wishes &amp; regards,

MustLive

Administrator of Websecurity web site

<a href="http://websecurity.com.ua/">http://websecurity.com.ua</a>