Vulnerability found:
03 May 2013
Vendor informed:
17 May 2013
Severity level:
Medium
Credits:
Amir Azam of ProCheckUp Ltd (www.procheckup.com)
Description:
A parameter has been identified which when modified with a malicious request, redirects a user to an external domain URL.
Successfully tested on:
Affected DNN Enterprise version: 07.00.05
Notes:
Admin level authentication is required for this attack.
Proof of concept:
Step1: go to http://target-domain.foo/login
Step2: paste http://target-domain.foo/AboutUs/tabid/99/ctl/Tab/action/edit/Default.aspx?returnurl=http://www.procheckup.com
or click on 'Page Settings' option under 'Page' menu and add "?returnurl=http://www.procheckup.com" to the end of URL like above.
step3: click on 'Cancel' button and victim will be redirected to www.procheckup.com web site
Consequences:
Such a URL could be used by attackers to redirect users to malicious sites.
For the attack to be successful the attacker would have to trick the victim into following the URL.
A typical attack scenario would be for the attacker to send the link to employees of company X. Because the URL contains information related to company X, the victim will be more likely to trust it and follow it. If followed, the URL could redirect the victim to the attacker's malicious website. This could be a phishing website made to look like the login page of company X's website. If the victim is fooled into believing that the website is legitimate, they may enter their credentials which would then be captured by the attacker.
How to fix:
Update DNN to 7.1.1 or filter colon ‘:’ and forward slash ‘/’ characters from the vulnerable parameter. Only allow redirects within the same domain (relative URLs as opposed to absolute URLs).
References:
Affected DNN Enterprise version: 07.00.05
Legal:
Copyright 2013 ProCheckUp Ltd. All rights reserved.
Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to ProCheckUp, and provided such reproduction and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. ProCheckUp is not liable for any misuse of this information by any third party.
Categories