RCBlog 1.03 Authentication Bypass

vendor:

RCBlog

by:

Danny Moules

7.5

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: RCBlog

Affected Version From: RCBlog 1.03

Affected Version To: RCBlog 1.03

Patch Exists: No

Related CWE: N/A

CPE: noahmedling.com

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

RCBlog 1.03 Authentication Bypass

RCBlog 1.03 is vulnerable to an authentication bypass vulnerability. By default, the application provides public access to the text file which stores the MD5 hashes of the username/password and these can be found at http://www.example.com/rcblog/config/password.txt. By combining the hashes into one large string and crafting it in a “rcb_id” cookie in the following order: Directory -> IP Address -> Username -> Password, an attacker can gain administrative privileges.

Mitigation:

Ensure that the application is not providing public access to the text file which stores the MD5 hashes of the username/password.

Source

Exploit-DB raw data:

Vendor: http://noahmedling.com
Version(s): RCBlog 1.03 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes

See PUSH 55 Advisory at https://www.push55.co.uk/index.php?s=ad&id=4

----

By default, the application provides public access to the text file which stores the MD5 hashes of the username/password and these can be found at:

http://www.example.com/rcblog/config/password.txt

These two hashes represent the username (first) and the password (second).

By default these are 9d0aea34e0f22cff881feb82c79ce76a and e20eeabd7d13800e1c30043b269fbc86 respectively.

We need two more hashes to fake the required credentials:

One is the MD5 hash of $_SERVER['PHP_SELF'] which is in this case "/rcblog" -> ad624ca84b593d66e3685e83e4a3618e

The other is the the MD5 hash of the public IP of the user, let's say "192.168.1.5" -> 2e9e9f7c017ee2a1645a236d182fb28c

Finally we combine the hashes into one large string and craft it in a "rcb_id" cookie in the following order:

Directory -> IP Address -> Username -> Password

Resulting in:

9d0aea34e0f22cff881feb82c79ce76ae20eeabd7d13800e1c30043b269fbc86ad624ca84b593d66e3685e83e4a3618e2e9e9f7c017ee2a1645a236d182fb28c

We are then logged in with administrative privileges.

# milw0rm.com [2009-01-19]