View Issue Details

Jump to NotesJump to History
This issue affects 1 person(s).
 256
IDProjectCategoryView StatusDate SubmittedLast Update
10508Bug reportsSecuritypublic2016-02-17 16:502016-04-13 11:53
ReporterNGIIGN Assigned Toc_schmitz  
PrioritynormalSeverityminor 
Status closedResolutionno change required 
Product Version2.06+ 
Summary10508: Possibility for "Expression language injection"
Description

Dear,

We ran some standard web security checks to see if it is safe to install your software package in our DMZ zone. This checkup returned one high alert: there is a possibility for "Expression language injection". I added the details regarding this alert in this ticket, I hope it's enough information to reproduce this bug.

Kind regards,

Kris.

Steps To Reproduce

The software that performed the security check returned the following details (226619 is the number of the test survey that we created for this checkup):

Affected items:
/limesurvey/index.php/226619/

Details:
URL encoded POST input loadname was set to ${9999944-10454}
Pattern found: 9989490

Request headers:
POST /limesurvey/index.php/226619 HTTP/1.1
Content-Length: 120
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=0fii03tgep0jh06ogtgbo476m4;
YII_CSRF_TOKEN=3810ffcd882da7bd900f85e5eb10c1f43fcf6475
Host: xxxx.xxx
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko)
Chrome/41.0.2228.0 Safari/537.21
Accept: /
loadall=reload&loadname=%24%7b0%2b0%7d&loadpass=g00dPa%24%24w0rD&YII_CSRF_TOKEN=3810ffcd
882da7bd900f85e5eb10c1f43fcf6475

Recommendation:
Perform data validation best practice against untrusted input and to ensure that output encoding is applied when data
arrives on the EL layer, so that no metacharacter is found by the interpreter within the user content before evaluation.
The most obvious patterns to detect include ${ and #{, but it may be possible to encode or fragment this data.

TagsNo tags attached.
Bug heat256
Complete LimeSurvey version number (& build)limesurvey206plus-build1512
I will donate to the project if issue is resolvedNo
Browser
Database type & versionMySQL
Server OS (if known)Debian 8 Jessie
Webserver software & version (if known)Apache 2.4.10
PHP Version5.6.17
Git branch / Pull Request URL

Users monitoring this issue

There are no users monitoring this issue.

Activities

c_schmitz

c_schmitz

2016-02-17 17:54

administrator   ~35327

HI,

expression language injection requires an EL interpreter (like JSP) server-side installed. It is a very theoretical threat as LimeSurvey does not need JSP and serves no JSP.
Do you agree?
c_schmitz

c_schmitz

2016-02-21 19:55

administrator   ~35483

Feedback please?
NGIIGN

NGIIGN

2016-02-24 13:36

reporter   ~35650

Hi,
Sorry for the late answer.

It seems it’s not so theoretical : in the details posted earlier ,
the check and the result show that in this Post operation, survey user sends a mathematical operation to the server and the server sends back the answer to the calculation instead of turning down the query.

( Sent : limesurvey/index.php/9999944-10454
Sent back limesurvey/index.php/9989490 )

The operation should have been more harmful.

Is it a heavy investment for you to perform a check on this Post input, to allow numbers only and exclude extra characters?
Positive or “white list” input validation is recommended by OWASP, especially when special characters are not required.
Kinds regard.
c_schmitz

c_schmitz

2016-02-29 15:57

administrator   ~35786

I cannot reproduce this with a standard webserver - question is if we are reponsible if someone runs LimeSurvey on a JSP server?

I think not - it is never been intendet for that and not support on that.
DenisChenu

DenisChenu

2016-02-29 15:57

developer   ~35787

Actaully : seems to be EM :
{123+456} seems to be evaluatded by EM ?

It's an issue or not ? Can you find a way to broke a server security here ?
c_schmitz

c_schmitz

2016-02-29 16:31

administrator   ~35788

Yes, it seems to be EM. I don't currently see a way to comprimise server security this way. All you can do is add numbers, there are no functions to output strings, because the quotes are encoded.

However if at some later time we add more powerful functions to EM we have to revisit this subject.
NGIIGN

NGIIGN

2016-03-14 09:34

reporter   ~36458

Thank you for the answer. I still have a question.
What the benefits of allowing at this place (limesurvey/index.php/NNNN) an expression instead of only an integer ?
If no particular benefits, is it a heavy cost for you to restrict the input to only integer?
NGIIGN

NGIIGN

2016-04-11 16:21

reporter   ~37230

Feedback please?
c_schmitz

c_schmitz

2016-04-11 16:31

administrator   ~37231

loadname is not supposed to be an integer, but a string.

Issue History

Date Modified Username Field Change
2016-02-17 16:50 NGIIGN New Issue
2016-02-17 17:54 c_schmitz Note Added: 35327
2016-02-21 19:55 c_schmitz Note Added: 35483
2016-02-24 13:36 NGIIGN Note Added: 35650
2016-02-29 15:57 c_schmitz Note Added: 35786
2016-02-29 15:57 DenisChenu Note Added: 35787
2016-02-29 16:31 c_schmitz Note Added: 35788
2016-02-29 16:31 c_schmitz Status new => closed
2016-02-29 16:31 c_schmitz Assigned To => c_schmitz
2016-02-29 16:31 c_schmitz Resolution open => suspended
2016-03-14 09:34 NGIIGN Note Added: 36458
2016-03-14 09:34 NGIIGN Status closed => feedback
2016-03-14 09:34 NGIIGN Resolution suspended => reopened
2016-04-11 16:21 NGIIGN Note Added: 37230
2016-04-11 16:21 NGIIGN Status feedback => assigned
2016-04-11 16:31 c_schmitz Note Added: 37231
2016-04-13 11:53 c_schmitz Status assigned => closed
2016-04-13 11:53 c_schmitz Resolution reopened => no change required