Multiple Vulnerabilities in the New CyberForum Portal

Security researchers from aramido found several security vulnerabilities on the CyberForum site. These vulnerabilities were reported to the site operator in accordance with the responsible disclosure of security vulnerabilities process . According to the CyberForum, the site has since been updated with fixes for the vulnerabilities. This article describes the vulnerabilities found, as they can occur in a similar way on many other websites with user-generated content.

The CyberForum Website as a Prototype of a Community Website

With over 1,000 members, the CyberForum is one of the largest networks for high-tech and IT companies in Europe. Members are companies from the entire southwestern German region. With its various offers for companies, startups, investors, apprentices, and students, the CyberForum is a strong location factor, especially for the Technology Region Karlsruhe. As an IT company, aramido GmbH is also a member of the CyberForum and greatly appreciates the versatile offers. With the launch of the new website based on Typo3 on July 20, 2016, the CyberForum introduced various offers for its members. In addition to maintaining their own profile on the site, they can post news, announce dates and place job advertisements. To create this content, the open source Medium Editor was used as a rich text editor.

Persistent Cross-Site Scripting (XSS) on the CyberForum Website

The first security vulnerability found by aramido concerns the creation of new content. One of the basic rules of secure software development and thus also a focus of aramido's Secure Coding training is to validate all user inputs on the server side and to mask all outputs. These rules were obviously not followed. Instead, a client-side validation of the JavaScript rich text editor was used. Fundamentally, a check on the client side is only a feature to improve the usability of a page, but not a security check, as inputs can still be arbitrarily manipulated by attackers before being sent to the server. Due to insufficient validation and masking of user content, anyone with access to a member account was able to permanently store JavaScript code on the CyberForum website. Further information on this persistent XSS vulnerability can be found in the aramido security advisory ARAMIDO-2017-001.

Missing Authorization when Editing and Deleting Articles

While checking the remediation status of the XSS vulnerability, aramido security researchers noticed further security vulnerabilities, which in combination would have been even more serious than the first XSS vulnerability discovered. Due to a missing check of the access permissions of logged-in users paired with a Cross Site Request Forgery (CSRF) security vulnerability, an attacker would have been able to build a manipulated website that, when visited by a logged-in CyberForum member, would have deleted all user-generated content of all CyberForum members. These security vulnerabilities were summarized in the security advisory ARAMIDO-2017-002 Unauthorized Editing and Deletion of Content on the CyberForum Website and reported to the operator.

Conclusion

The found security vulnerabilities are typical vulnerabilities of web applications that the pentesters from aramido regularly discover in penetration tests of web applications . Therefore, the recommendation is: new websites and other applications should be checked by an independent third party through a penetration test before publication and after significant changes.

aramido GmbH thanks the CyberForum for the good cooperation during the vulnerability remediation. According to the CyberForum, the vulnerabilities have since been addressed through updates to the website.