Security error

[rramos]

It seems the ability to forward a user to a page outside the organitation when performing authentication. This is due to incorrect data validation entry. A potential attacker could use this vulnerability to perform redirects customized without user intervention and thus modified redirect to another page. of This enables you to perform other types of attacks, such as data theft user or session.

In tests carried out in our development servers has been detected in one of the server requests that are made
during the authentication process in the application, there is a parameter "source" in which includes a return address that can be manipulated.

How can we correct this vulnerability?

Thanks!!

[JasonNugent]

Hi rramos,

You're correct, the redirection that occurs after login should be sanitized to ensure that it is to a page within OJS. However, the risk in the current situation is quite low -- someone wishing to redirect you to a page of their choosing would need to a) know that you had an account within an OJS installation or an active session, and b) convince you somehow to follow their crafted link.

I have filed this as a bug at http://pkp.sfu.ca/bugzilla/show_bug.cgi?id=7959 if you wish to add yourself to the CC list in order to be notified when it is fixed.

Regards,
Jason

[rramos]

thank you very much for your help

[rramos]

If anyone is interested I modified the code:
lib/pkp/pages/login/PKPLoginHandler.inc.php

In this file I created a small patch:

Code: Select all

        function antiXSS(&$source) {
      $str = strpos($source,'/');
      if($str == 0 ) {
         $source="";
      }
   }


and in this other function called my function:

Code: Select all

 function signIn() {
      $this->validate();
      $this->setupTemplate();
      if (Validation::isLoggedIn()) {
         PKPRequest::redirect(null, 'user');
      }

      if (Config::getVar('security', 'force_login_ssl') && Request::getProtocol() != 'https') {
         // Force SSL connections for login
         PKPRequest::redirectSSL();
      }

      $user = Validation::login(Request::getUserVar('username'), Request::getUserVar('password'), $reason, Request::getUserVar('remember') == null ? false : true);
      if ($user !== false) {
         if ($user->getMustChangePassword()) {
            // User must change their password in order to log in
            Validation::logout();
            PKPRequest::redirect(null, null, 'changePassword', $user->getUsername());

         } else {
            $source = Request::getUserVar('source');
            $this->antiXSS($source); // MY FUNCTION


It's silly but it works

GREETINGS!!