Tried, Tested and Proven

Vulnerability title: Unauthenticated Backup and Password Disclosure In HandsomeWeb SOS Webpages

CVE: CVE-2014-3445
Vendor: HandsomeWeb
Product: SOS Webpages
Affected version: 1.1.11 and earlier
Fixed version: 1.1.12
Reported by: Freakyclown

Details:

The default setup allows an unauthenticated user to access administrative functions such as backing up of key files within the CMS. This is done by appending the following to a domain using the software affected:

/backup.php?a=2&k=6f15afa1ac4edea0g145e884116334b7

Where “a” is the file number to back up and “k” is the MD5key used to authenticate the administrator, however if “k” does not match the correct key rather than disallowing the unauthenticated user to back up the file the service will provide the user with the correct key. For example:

Failure, wrong key. The right key is 5f17aca1ae2edea0f145e884116371a5

Using this new key in the url such as below:

/backup.php?a=2&k=5f17aca1ae2edea0f145e884116371a5

will allow the user to perform the backup of files.

In addition to this the key is generated by the code:

$backupkey=MD5

Making it trivial to recover the key provided above to gain the administrators password and obtain further control over the site.

Impact:

This vulnerability allows anyone to access the backup files unauthenticated and provides you with a hash of the administrator password.

Exploit:

Exploit code not required.


Vendor status:

23/04/2014 Advisory created
23/04/2014 Vendor contacted
24/04/2014 Vendor working on a fix
02/05/2014 Fix released
16/05/2014 CVE obtained
27/05/2014 Published
Copyright:

Copyright © Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.