aushack.com - Vulnerability Advisory
-----------------------------------------------
Release Date:
 22-Sep-2006

Software:
 Squiz - My Source and My Source Matrix
 http://www.squiz.net.au

 "MySource Matrix is the newest version of the popular MySource CMS,
 purpose built for enterprise level installations. It boasts all the
 features of high-end systems such as highly configurable workflow,
 a powerful integrated search engine, intuitive front-end editing, true
 rollback and much more."

Versions affected:
 MySource Matrix 3.8 and below, MySource 2.x.

Vulnerability discovered:

 MySource Matrix may be used as an unauthorised HTTP proxy (and XSS).

Vulnerability impact:

 Low - An anonymous user may use the MySource based website as a proxy.
       Additionally, proxied bandwidth may be at great financial expense.
       Remote content may contain JavaScript which is client executed.

Vulnerability information

 A function of the software 'sq_remote_page_url' allows inclusion of remote
 content in the body of the website.

 Example: (wrapped)
  http://www.mysource-example.com.au/$page?sq_remote_page_action=
  fetch_url&sq_remote_page_url=http://www.google.com.au

  ... where '$page' is a valid CMS reference, e.g. 'about_us'.

  This will return the Google website, encapsulated in the header
  and footer HTML of the www.mysource-example.com.au site.

  The remote page may contain JavaScript for XSS purposes, e.g. cookies.

  Remote PHP inclusion does not appear to be possible (returns % hex value).

  One could write a script to enable a world wide anonymous proxy array.

Solution:
 The vendor does not consider this a vulnerability. Newer versions of the
 software include a function 'sq_content_src' to hide the URL (Base64),
 in addition to use of a string whitelist to permit inclusion, for example:

 if whitelist = http://www.trust-content.com/index?id=*, where * = <wildcard>
      ok  = http://www.trust-content.com/index?id=1234
     bad = http://www.trust-content.com/index?ref=1234

 Note that whilst the URL is Base64 encoded, this does not necessarily mean
 that whitelists are used. Future releases may be proxied via:

 http://www.mysource-example.com.au/$page?
 sq_content_src=aHR0cDovL3d3dy5nb29nbGUuY29tLmF1

References:
 aushack.com advisory
 http://www.aushack.com/advisories/200607-mysourcematrix.txt

Credit:
 Patrick Webster ( patrick@aushack.com )

Disclosure timeline:
 27-Apr-2006 - Discovered during audit, Squiz notified shortly after.
 07-Jun-2006 - Sent security patch query to Squiz developers.
 09-Jun-2006 - Squiz response - use whitelist function.
 22-Sep-2006 - Public disclosure.

EOF