bbcodes security bugs

kreon · Post by **kreon** » Thu Apr 14, 2005 4:46 pm

I think you need to patch your bbcode-plugin (if you use it).
Path is here:
http://adz.void.ru/index.php?file&id=11
Vendor was informed, but no action was maded to fix it, so I did it myself.

Post by **garvinhicking** » Thu Apr 14, 2005 4:48 pm

This is so not true. The "vendor" (in that case me) was notified 15 minutes before. I posted a mail to our mailinglist, as a proof of response and told kreon that I would look into this.

A patch will be made public from us, officially. But give us more than 15 minutes, alright.

kreon · Post by **kreon** » Thu Apr 14, 2005 4:57 pm

As I said before, this is a critical vulnerability...
F.e. - this is a cookie with admin session cached with script

Code: Select all

serendipity[author_information]=YToyOntzOjg6InVzZXJuYW1lIjtzOjc6ImpvaG5kb2UiO3M6ODoicG
Fzc3dvcmQiO3M6Nzoiam9obmRvZSI7fQ%3D%3D;%
20phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%
22autologinid%22%3Bs%3A32%3A%
2221232f297a57a5a743894a0e4a801fc3%22%3Bs%3A6%3A%
22userid%22%3Bs%3A1%3A%222%22%3B%7D;%
20w3t_myid=2;%
20PHPSESSID=657db285fa6208ac58433c6f0051dab7

Fully login data

I can replace it in my browser to working as admin

So, if you use bbcodes, turn it off or install patch.

Post by **garvinhicking** » Thu Apr 14, 2005 6:51 pm

I have created a new patch which hopefully fixes the BBCodes properly, without affecting user-made HTML markup (for entries, not comments).

You can download the new version at http://www.netmirror.org/mirror/serendi ... bbcode.php or http://www.netmirror.org/mirror/serendi ... bcode.phps

I'd be happy to get some feedback and include this file in the upcoming Serendipity release.

Regards,
Garvin

Lesur · Post by **Lesur** » Thu Apr 14, 2005 7:24 pm

Both read it as a .php or maybe I am missing something.

Post by **jhermanns** » Thu Apr 14, 2005 7:25 pm

Lesur wrote:Both read it as a .php or maybe I am missing something.

If you are not, I am

Lesur · Post by **Lesur** » Thu Apr 14, 2005 7:34 pm

Ok I guess I wasn't clear. Not the first time.

To me both links look like semi-processed php, but the .php header is missing and other information doesn't fully jive with the current event_bbcode file.

Here are the first few lines in the files:

Code: Select all

BBCode-Formatierung erlaubt'); break; case 'en': default: @define('PLUGIN_EVENT_BBCODE_NAME', 'Markup: BBCode'); @define('PLUGIN_EVENT_BBCODE_DESC', 'Markup text using BBCode'); @define('PLUGIN_EVENT_BBCODE_TRANSFORM', 'BBCode format allowed'); break; } class serendipity_event_bbcode extends serendipity_event { var $title = PLUGIN_EVENT_BBCODE_NAME; function introspect(&$propbag) { global

Lesur · Post by **Lesur** » Thu Apr 14, 2005 7:41 pm

I am so smart, I am so smart ... S..A..M..R..T ....

Right click and download works fine. Sorry for the line noise.

bbcodes security bugs

bbcodes security bugs

Re: bbcodes security bugs

Neither link gives the raw .php file

Re: Neither link gives the raw .php file

clear as mud

In the words of Homer Simpson