Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:28923
HistoryJan 02, 2013 - 12:00 a.m.

BF, CSRF, AoF and IAA vulnerabilities in MODx Revolution

2013-01-0200:00:00
vulners.com
36
JSON

Hello 3APA3A!

I want to warn you about multiple vulnerabilities in MODx Revolution.

These are Brute Force, Cross-Site Request Forgery, Abuse of Functionality and Insufficient Anti-automation vulnerabilities in MODx. It's about 2.x (Revolution) versions of MODx. In 0.x and 1.x (Evolution) versions of MODx CMS there are much more holes, about which I've wrote earlier. Developers changed the code of their CMS in 2.x versions, which decreased number of vulnerabilities (like DoS hole, but Login Enumeration hole just changed into different one). As I've found at tested web site - one Ukrainian government site, also there were multiple XSS holes on it (which are still not fixed), which were not related to core of engine, it was custom code.

Affected products:

Vulnerable are all versions of MODX Revolution (2.x versions of engine).

Details:

Brute Force (WASC-11):

In login form (http://site/manager/) there is no protection from Brute Force attacks.

Cross-Site Request Forgery (WASC-09):

Lack of captcha in login form (http://site/manager/) can be used for different attacks - for CSRF-attack to login into account (remote login - to conduct attacks on vulnerabilities inside of account), for automated entering into account, for phishing and other automated attacks. Which you can read about in the article "Attacks on unprotected login forms" (http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html).

Abuse of Functionality (Login Enumeration) (WASC-42):

In login form (http://site/manager/) Login Enumeration is possible. Different messages are shown for correct and incorrect logins.

Insufficient Anti-automation (WASC-21):

In login form there is no protection against automated request, which allow to picking up logins in automated way by attacking on login function and by attacking on password recovery function it's possible to reveal users' emails. Both functionals are placed at the same page.

Timeline:

2012.06.28 - announced at my site about MODx Evolution.
2012.06.28 - informed developers about the first part of vulnerabilities in MODx Evolution.
2012.06.30 - informed developers about the second part of vulnerabilities in MODx Evolution.
2012.07.26 - announced at my site about MODx Revolution.
2012.07.28 - informed developers about vulnerabilities in MODx Revolution and reminded about previous two letters.
2012.07.28-2012.10.31 - during conversation with developers about MODx Revolution, I was constantly reminding them, that I've sent them info about holes in Evolution and I can resent them, because it was clear that they missed it (they only were answering concerning Revolution).
2012.11.02 - after developers said they want to see this information (missed by them in June), I've resent the first two letters to the developers.
2012.12.27 - disclosed at my site (http://websecurity.com.ua/5981/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

JSON