osTicket 1.9.12 XSS / File Upload / Access Bypass / Session Fixation
Posted on 08 February 2016
============================================= - Release date: February 04th, 2016 - Discovered by: Giovanni Cerrato and Enrico Cinquini - Severity: High ============================================= I. VULNERABILITY ------------------------- osTicket multiple vulnerabilities. II. INTRODUCTION ------------------------- Last version of osTicket (v1.9.12) is affected by multiple vulnerabilities. III. DESCRIPTION ------------------------- 1) UPLOAD HTML FILE It is possible to upload files attached to a ticket at URL: https://hostname/upload/open.php There are some controls to block not allowed file (e.g php,html) but they are only client-side and not server-side so they can be easily bypassed using tool like Burp suite.They will be uploaded and reachable at specific URL like the following example: https://hostname/file.php?key=qycj1msethqx49ilidrwxrurvebbsipa&expires=1447372800&signature=6ee71ea7dee17cac30a884f4cf823c6734e1115d This vulnerability could be used for example to perform XSS attack or to upload a fake login page. 2) MISSIMG FUNCTION LEVEL ACCESS CONTROL It is possible to access to some contents of the web application without authentication. It is allowed to view all ticket attachment only by calling their URLs like following: https://hostname/file.php?key=qycj1msethqx49ilidrwxrurvebbsipa&expires=1447372800&signature=6ee71ea7dee17cac30a884f4cf823c6734e1115d . This vulnerability combined with unrestricted HTML upload can be used to realize phishing and/or XSS attack via email. To achieve this tasks anyone needs to upload an HTML file containing malicious Javascript or phishing page and then spread the associated URL. 3) STORED CROSS SITE SCRITPING The application is vulnerable to some stored XSS attack. URL: https://hostname/scp/users.php Functionality: Add User Form parameter affected: Internal Notes URL: https://hostname/scp/orgs.php Functionality: Add Organization Form parameter affected: Name, Internal Notes URL https://hostname/scp/categories.php Functionality: Add New Category Form parameter affected: Category Description, Internal Notes URL https://hostname/scp/departments.php Functionality: Add New Department Form parameter affected: Department Signature URL: https://hostname/scp/teams.php Functionality: Add New Team Form parameter affected: Admin Notes, Name URL: https://hostname/scp/groups.php Functionality: Add New Group Form parameter affected: Admin Notes URL: https://hostname/scp/banlist.php Functionality: Ban New Email Form parameter affected: Admin Notes URL: https://hostname/scp/profile.php Functionality: Edit profile Form parameter affected: Signature A proof of concept can be obtained using the following Javascript code: <IFRAME onload=alert(1);></IFRAME> 4) SESSION FIXATION The application does not regenerate session id cookie (OSTSESESSID) after authentication so it is prone to session fixation attack. This vulnerability can be used to hijack a valid user session. IV. BUSINESS IMPACT ------------------------- An attacker could upload malicious file, hijack a valid user session, perform XSS or phishing attacks and access to sensible information. V. SYSTEMS AFFECTED ------------------------- Version 1.9.12 is vulnerable. VI. SOLUTION ------------------------- It's necessary to: - implement a strong upload filter to prevent the upload of malicious file - implement an input validation mechanism to avoid being vulnerable to XSS injection - review and correct access control to prevent that unauthenticated users can access to sensible documents VII. REFERENCES ------------------------- osticket website: http://osticket.com/ VIII. CREDITS ------------------------- The vulnerability has been discovered by: Giovanni Cerrato cerrato(dot)gianni(at)gmail(dot)com Enrico Cinquini enrico(dot)cinquini(at)gmail(dot)com IX. ADVISORY TIMELINE ------------------------- November 10th, 2015: Vulnerability identification November 17th, 2015: First contact with vendor November 19th, 2015: Vendor notified November 25th, 2015: Asking for status update November 30th, 2015: Vendor response; investigating December 16th, 2015: Asking for status update December 18th, 2015: Vendor says that the vulnerabilities will be fixed in the new version January 11th, 2016: Provided more details to vendor January 25th, 2016: Asking for status update February 02th, 2016: Advised vendor public disclosure date will be February 04th February 02th, 2016: Vendor provides status update(still investigating) February 04th, 2016: Public disclosure X. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. We accept no responsibility for any damage caused by the use or misuse of this information.
