Home page logo

bugtraq logo Bugtraq mailing list archives

[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities
From: admin () majorsecurity de
Date: 23 Jul 2006 10:24:08 -0000

[MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities

Software: Woltlab Burning board

Impact: Cookie manipulation and Session Fixation

Made public: July, 23th 2006 

Vendor: WoltLab GmbH

Page: http://www.woltlab.de

Discovered by: David Vieira-Kurz

Original Advisory:

Affected products:
Woltlab Burning board 1.1.1
Woltlab Burning Board 1.2
Woltlab Burning Board 2.1.3
Woltlab Burning Board 2.1.5
Woltlab Burning Board 2.2
Woltlab Burning Board 2.2.1
Woltlab Burning Board 2.2.2
Other versions may also be affected...

register_globals = On 

Cookie manipulation and session fixation attack:
Session Fixation is an attack technique that forces a user's session ID to an explicit value. 
Depending on the functionality of the target web site, a number of techniques can be utilized to "fix" the session ID 
These techniques range from Cross-site Scripting exploits to peppering the web site with previously made HTTP requests. 
After a user's session ID has been fixed, the attacker will wait for them to login. 
Once the user does so, the attacker uses the predefined session ID value to assume their online identity. 

WBB 1.1.1 and 1.2:
        The Cookie variable "sid" can be set to something like:

        2. sid=>'><script>alert(123456789)</script>;sthreads=a%253A1%253A%257Bi%253A0%253BN%253B%257D  // XSS is 
        3. Cookie: sid='";sthreads=a%253A1%253A%257Bi%253A0%253BN%253B%257D // SQL-Injection could be possible

WBB 2.1.x and 2.2.x:
        The Cookie variable "wbb2_lastvisit" can be set to something like:

 // XSS is possible

1. Do not accept session identifiers from GET / POST variables:
        Session identifiers in URL (query string, GET variables) or POST variables are not recommended as it simplifies 
this attack - it is easy to make links or forms which sets GET / POST variables.

2.Regenerate SID on each request:
        A powerful countermeassure against session fixation is to "regenerate" session identifier (SID) on each 
        This means that although attacker may trick a user into accepting a known SID, the SID will be invalid when 
attacker attempts to re-use the SID.

3. Accept only server generated SID:
        One way to improve security is to not accept session identifiers not generated by server.

        if ( ! is_set( $_SESSION['SERVER_GENERATED_SID'] ) ) {
           session_destroy(); // destroy all data in session
        session_regenerate_id(); // generate a new session identifier


  By Date           By Thread  

Current thread:
  • [MajorSecurity #26] Woltlab Burning Board - Multiple Cookie manipulation and session fixation vulnerabilities admin (Jul 24)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]