I want to warn you about multiple vulnerabilities in MODx Revolution.
These are Brute Force, Cross-Site Request Forgery, Abuse of Functionality
and Insufficient Anti-automation vulnerabilities in MODx. It's about 2.x
(Revolution) versions of MODx. In 0.x and 1.x (Evolution) versions of MODx
CMS there are much more holes, about which I've wrote earlier. Developers
changed the code of their CMS in 2.x versions, which decreased number of
vulnerabilities (like DoS hole, but Login Enumeration hole just changed into
different one). As I've found at tested web site - one Ukrainian government
site, also there were multiple XSS holes on it (which are still not fixed),
which were not related to core of engine, it was custom code.
-------------------------
Affected products:
-------------------------
Vulnerable are all versions of MODX Revolution (2.x versions of engine).
----------
Details:
----------
Brute Force (WASC-11):
In login form (http://site/manager/) there is no protection from Brute Force
attacks.
Cross-Site Request Forgery (WASC-09):
Lack of captcha in login form (http://site/manager/) can be used for
different attacks - for CSRF-attack to login into account (remote login - to
conduct attacks on vulnerabilities inside of account), for automated
entering into account, for phishing and other automated attacks. Which you
can read about in the article "Attacks on unprotected login forms"
(http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-April/007773.html).
Abuse of Functionality (Login Enumeration) (WASC-42):
In login form (http://site/manager/) Login Enumeration is possible.
Different messages are shown for correct and incorrect logins.
Insufficient Anti-automation (WASC-21):
In login form there is no protection against automated request, which allow
to picking up logins in automated way by attacking on login function and by
attacking on password recovery function it's possible to reveal users'
emails. Both functionals are placed at the same page.
------------
Timeline:
------------
2012.06.28 - announced at my site about MODx Evolution.
2012.06.28 - informed developers about the first part of vulnerabilities in
MODx Evolution.
2012.06.30 - informed developers about the second part of vulnerabilities in
MODx Evolution.
2012.07.26 - announced at my site about MODx Revolution.
2012.07.28 - informed developers about vulnerabilities in MODx Revolution
and reminded about previous two letters.
2012.07.28-2012.10.31 - during conversation with developers about MODx
Revolution, I was constantly reminding them, that I've sent them info about
holes in Evolution and I can resent them, because it was clear that they
missed it (they only were answering concerning Revolution).
2012.11.02 - after developers said they want to see this information (missed
by them in June), I've resent the first two letters to the developers.
2012.12.27 - disclosed at my site (http://websecurity.com.ua/5981/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
//The information contained within this publication is
//supplied "as-is"with no warranties or guarantees of fitness
//of use or otherwise. Bot24, Inc nor Bradley Sean Susser accepts
//responsibility for any damage caused by the use or misuse of
//this information