WiKID wClient-PHP <= 3.0-2 Multiple XSS Vulnerabilities

  Name              Multiple Vulnerabilities in wClient-PHP
  Systems Affected  wClient-PHP 3.0-2 and earlier versions
  Severity          Medium
  Impact (CVSSv2)   Medium (5/10, vector: AV:N/AC:L/Au:N/C:C/I:N/A:N)
  Vendor            http://www.wikidsystems.com/
  Advisory          http://www.ush.it/team/ush/hack-wclient/wikid.txt
  Author            Francesco "ascii" Ongaro (ascii AT ush DOT it)
                    Antonio "s4tan" Parata (s4tan AT ush DOT it)
  Date              20080411

I. BACKGROUND

 From the WiKID website: "The WiKID Strong Authentication System is a
dual-source, software-based two-factor authentication system designed
to be less expensive and more extensible than hardware tokens."

II. DESCRIPTION

In the wClient-PHP package PHP_SELF is echoed back to the client
without proper sanitization leading to XSS issues.

WiKID mantainers have released a new version of the software (3.0-3)
that fixes exposed vulnerabilities and can be downloaded from the url:

http://www.wikidsystems.com/downloads/network-clients

Users that based their implementations on the code contained in
sample.php are advised to upgrade.

III. ANALYSIS

During a review of the wClient-PHP-3.0-1.tar.gz package (an additional
component of WiKID with network client functions) the following
vulnerabilities were identified in the sample code:

file sample.php, line 251: PHP_SELF insecure usage leads to XSS

<form action="<?php echo $PHP_SELF ?>" method="POST" >

file sample.php, line 269: PHP_SELF insecure usage leads to XSS

<form action="<?php echo $PHP_SELF ?>" method="POST" >

file sample.php, line 279: PHP_SELF insecure usage leads to XSS

<form action="<?php echo $PHP_SELF ?>" method="POST" >

file sample.php, line 292: possible PHP_SELF insecure usage leads to XSS

<form action="<?php echo $PHP_SELF ?>" method="POST" >

This one was not verified since it's not enabled in the version I have
downloaded but probably it's exploitable in the exact same way as
the other ones.

file sample.php, line 306: PHP_SELF insecure usage leads to XSS

<form action="<?php echo $PHP_SELF ?>" method="POST" >

$PHP_SELF can be exploited by requesting an URL like file.php/<XSS>.

Note: On recent PHP versions $PHP_SELF should be $_SERVER['PHP_SELF'].

In case of register_globals=On on recent versions where the variable
is undefined it's possible to override it by issuing PHP_SELF with
the wished value in GPC (GET, POST, COOKIE).

On old version of PHP it's possible to drive the value of PHP_SELF by
GLOBALS poisoning [1].

Version 3.0-2 fix $PHP_SELF instances to $_SERVER['PHP_SELF'], users
are strongly advised to do not use this version as it doesn't correctly
fix presented vulnerabilities and is more exploitable than 3.0-1.

An attacker can steal UserID, Passcode, Domain code and Registration
code before they are sent back to the server itself and potentially
poison the navigation of the user and steal other sensitive informations
via social engineering (injecting additional fields in the form or
showing "additional functions" to the user) abusing user's trust.

Remediation consists in proper escaping the user controlled inputs.

[1] http://www.ush.it/2006/01/25/php5-globals-vulnerability/

VII. CVE INFORMATION

No CVE at this time.

VIII. DISCLOSURE TIMELINE

20080320 Bug discovered
20080320 Vendor contacted
20080411 Advisory released

IX. CREDIT

Francesco "ascii" Ongaro and Antonio "s4tan" Parata are credited with
the discovery of this vulnerability.

Francesco "ascii" Ongaro
web site: http://www.ush.it/
mail: ascii AT ush DOT it

Antonio "s4tan" Parata
web site: http://www.ictsc.it/
mail: s4tan AT ictsc DOT it, s4tan AT ush DOT it

X. LEGAL NOTICES

Copyright (c) 2008 Francesco "ascii" Ongaro

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without mine express
written consent. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email me for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.