Private Forum bug - 1.1.4

[repsycle]

Hi,

Spotted this last night:
hxxp:www.securityfocus.com/bid/26508 [nonactive]
(SMF Private Forum Messages Information Disclosure Vulnerability)

Is this a valid threat?

(Recent phpBB convert to SMF, easy as pie!)

Thanks,

[Ol' Wombat]

certainly SMF is still not security perfect - is there any software?

[repsycle]

Agreed. I must admit that SMF seems a lot more secure than other php-based forums

[Ben_S]

I can't replicate it myself & the way Search is coded, I highly doubt it's genuine.

[青山 素子]

Looking at the actual description of the exploit, it looks like a misconfiguration issue more than anything. Remember, the fact that something has a CVE number doesn't mean it is a real issue.

Thanks for reporting it, however.


I'll post the discussion messages from Bugtraq here (reporter e-mail and URL sanitized):

From: <h3llcode_at_REMOVED>
Date: 8 Nov 2007 13:40:19 -0000
('binary' encoding is not supported, stored as-is)
# Vulnerable: Simple Machine Forum [ALL Versions]
#
# Tested on SMF 1.1.4
#
# Type: Private Section,Posts,Information disclosure.
#
# Risk: Low / Medium
#
# Discovered By Seph1roth
#
# Site: REMOVED
#
# Explanation:
#
# If some section is rescricted only for staff,vips or private groups/members,this bug can be used for read entire section and message, without privileges.
#
# Example:
#
# In my forum i've a Staff area , and into that , there is a message that contain Bug,exploit or some others keywords...i'll put in the advanced search module
# this keywords ,and i select "show results as messages"...and tadaaa...my priv8 zone can be read by everyone...
#
# Greetz to all BlackRoots users!
#
# Shoutz to all kiddies!
Received on Nov 08 2007

From: <klynn.securityfocus_at_kevinlynn.com>
Date: 9 Nov 2007 17:52:58 -0000
('binary' encoding is not supported, stored as-is) This is the second SMF vulnerability announced in the recent weeks that appears to be caused by administrative misconfiguration rather than an error in SMF. I have tested this on a default SMF 1.1.4 test environment and it did not work for me.

Given the fact that previous messages from h3llcode or others in your REMOVED group make mention of the use of .htaccess for controlling access to sensitive areas, it seems likely that h3llcode has opened permissions to allow escalated privileges to others and is then attempting to control those privileges using .htaccess files. Either that or h3llcode is testing the advanced search from an account enabled with escalated privileges already.

h3llcode, please create a default SMF 1.1.4 test environment and report back on your findings. If it can be duplicated in a properly configured SMF forum, I'm very interested in knowing about it.

Thank you,
Kevin Lynn, CISSP
Received on Nov 09 2007

From: Jindrich Kubec <kubecj_at_asw.cz>
Date: Thu, 08 Nov 2007 23:36:58 +0100

At 14:40 8.11.2007, h3llcode_at_hotmail.it wrote:
># In my forum i've a Staff area , and into that , there is a message that
>contain Bug,exploit or some others keywords...i'll put in the advanced
>search module # this keywords ,and i select "show results as
>messages"...and tadaaa...my priv8 zone can be read by everyone...

Logged in my forum as an admin.
Went into private section, found some unique keyword.
Had it searched in advanced search, it was found (as expected)

Logged off.
Had it searched in advanced search, not found (as expected)

What's your point then?

Jindrich Kubec <kubecj_at_avast.com>
Received on Nov 09 2007

Personally, I just find it cool that ALWIL (Avast!) uses SMF for their forum.

[karlbenson]

Indeed it would appear to be the person misconfiguring their forum permissions.

I've tried it on 1.1.3, 1.1.4 and 2.0 beta 1 forums and have been unable to replicate it/.

[Sverre]

I've seen this reported a few times in the past (http://www.simplemachines.org/community/index.php?topic=167349.0), but I've never been able to reproduce it on any of my own SMF installs. I did however catch a glimpse of it in the example given here: http://www.simplemachines.org/community/index.php?topic=116008.0

In that case the SMF permissions appeared to be set up correctly, since the thread where the post originated from was off limits to me, so my guess is that it must have been something in the server configuration which affected the permissions during search...