Executive brief
Pagekit CMS, a content management system, contains a vulnerability that allows unauthorized individuals to take over user accounts. When the software's debug mode is active, attackers can intercept password reset tokens intended for legitimate users. This could lead to a complete compromise of the website's administration or user accounts, potentially resulting in data theft or site defacement.
Technical details
A weak password recovery mechanism (CWE-640) exists in Pagekit CMS before version 1.0.11. When the debug toolbar is enabled, sensitive information including password reset tokens is exposed in the debug logs. A remote attacker can retrieve the debug session ID from the login page and use it to access the debug bar data. By monitoring these logs, an attacker can capture the 'user' and 'key' parameters generated during a legitimate password reset request, allowing them to complete the reset process and take over the account. This vulnerability is mitigated by the requirement that the debug toolbar must be enabled and requires some user interaction (the victim must initiate a password reset).
Affected products
- Pagekit Pagekit CMS < 1.0.11
Timeline
- 2017-01-21: disclosed: Initial discovery and exploit publication by SecureLayer7
- 2017-01-25: advisory: NVD publication date
- 2017-01-25: patched: Pagekit version 1.0.11 released to address the issue
References
- http://www.securityfocus.com/bid/95806
- https://github.com/pagekit/pagekit/commit/e0454f9c037c427a5ff76a57e78dbf8cc00c268b
- https://securelayer7.net/download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf
- https://securelayer7.net/download/poc/password-reset-vulnerability-exploit-ruby-pagekit-cms.rb.txt
- https://www.exploit-db.com/exploits/41143/