My SpiderLabs Research colleague Jonathan Claudius recently identified an XSS flaw in the Movable Types application which was outlined in Trustwave Security Advisory TWSL2012-003. Here is the quick overview of the issue:
After extracting the Moveable Type CGI files and source files on to a webserver, but before the application is fully installed, cross-site scriptingvulnerabilities are present in the '/cgi-bin/mt/mt-wizard.cgi' page.Example(s):Performing XSS on "dbuser" parameter#RequestPOST /cgi-bin/mt/mt-wizard.cgi HTTP/1.1Host: A.B.C.DUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip, deflateAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7Proxy-Connection: keep-aliveReferer: http://A.B.C.D/cgi-bin/mt/mt-wizard.cgiContent-Type: application/x-www-form-urlencodedContent-Length: 216__mode=test&step=configure&set_static_uri_to=&default_language=en-us&config=&dbtype=mysql&dbserver=localhost&dbname=&dbuser=%3Cscript%3Ealert%28%27123%27%29%3C%2Fscript%3E&dbpass=test&dbpath=&dbport=&dbsocket=&test=1#Response<--------------snip-----------><p>Connection error: Access denied for user '<script>alert('123')</script>'@'localhost' (using password: YES) at /var/www/cgi-bin/mt/extlib/Data/ObjectDriver/Driver/BaseCache.pm line 320<--------------snip----------->
Here is a ModSecurity virtual patch for this issue that we added to our Commercial Rules Feed:
#
# (2100009) ModSecurity Rules from Trustwave SpiderLabs: Security Advisory TWSL2012-003: Cross-Site Scripting Vulnerability in Movable Type Publishing Platform
#
# https://www.trustwave.com/en-us/spiderlabs/advisories/TWSL2012-003.txt
#
SecRule REQUEST_FILENAME "@streq /cgi-bin/mt/mt-wizard.cgi" "chain,phase:2,t:none,block,id:'2100009',msg:'SLR: Security Advisory TWSL2012-003: Cross-site Scripting Attack in Movable Type Publishing Platform.',logdata:'%{matched_var}',severity:'2',tag:'WEB_ATTACK/XSS',tag:'https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt'"
SecRule ARGS_POST:dbuser "!^[a-zA-Z0-9]+$"
This virtual patch will ensure that the "dbuser" payload on the /cgi-bin/mt/mt-wizard.cgi script only contains alphanumeric characters.
From a time-to-fix perspective, this virtual patch was created very quickly. It took me all of about 5 minutes to develop. These rules can then be implemented across an entire server farm is short order to proctect all effected applications. Think of this from the perspective of a web hosting provider. They are the most at risk of this particular issues as they often initially provision applications such as Movable Types for this end users but then these applications wait, in this insecure state, until the user completes the installations.
Contrast this expediated timeline vs. the time it took the vendor to release a patch for this issue:
Revision History:01/11/12 - Vulnerability disclosed02/21/12 - Patch released02/24/12 - Advisory published
It took them an entire month to release a patch for users.
If you would like to learn more about virtual patching and try some hands on exercises, please consider joining me at the upcoming OWASP AppSecDC conference for the Virtual Patching Workshop. We will be diving in-depth on all these issues.