PR13-03 - DotNetNuke (DDN) redirect 'Phishing' attack
ProCheckUp Labs are dedicated to conducting research and raising the awareness of information security issues. The combination of ProCheckNet's response-driven AI technology and our experienced security consultants has led to the discovery of many security vulnerabilities and advisories during penetration testing assignments.
In 2008 ProCheckUp published more vulnerabilities than any other UK penetration testing company.
Over the years, ProCheckUp have been credited with finding vulnerabilities and advisories in products from vendors such as:
Microsoft - Aruba Networks - IBM - Novell - BEA Systems - Whale Communications - Netscape - Hummingbird - Apache- F5 Networks - GoAhead - Sun Microsystems
Advisories (Vulnerabilities) & Papers
- Vulnerability found:
- 03 May 2013
- Vendor informed:
- 17 May 2013
- Severity level:
- Amir Azam of ProCheckUp Ltd (www.procheckup.com)
- A parameter has been identified which when modified with a malicious request, redirects a user to an external domain URL.
Successfully tested on:
Affected DNN Enterprise version: 07.00.05
Admin level authentication is required for this attack.
- Proof of concept:
- Step1: go to http://target-domain.foo/login
Step2: paste http://target-domain.foo/AboutUs/tabid/99/ctl/Tab/action/edit/Default.aspx?returnurl=http://www.procheckup.com
or click on 'Page Settings' option under 'Page' menu and add "?returnurl=http://www.procheckup.com" to the end of URL like above.
step3: click on 'Cancel' button and victim will be redirected to www.procheckup.com web site
- How to fix:
Such a URL could be used by attackers to redirect users to malicious sites.
For the attack to be successful the attacker would have to trick the victim into following the URL.
A typical attack scenario would be for the attacker to send the link to employees of company X. Because the URL contains information related to company X, the victim will be more likely to trust it and follow it. If followed, the URL could redirect the victim to the attacker's malicious website. This could be a phishing website made to look like the login page of company X's website. If the victim is fooled into believing that the website is legitimate, they may enter their credentials which would then be captured by the attacker.
Update DNN to 7.1.1 or filter colon ‘:’ and forward slash ‘/’ characters from the vulnerable parameter. Only allow redirects within the same domain (relative URLs as opposed to absolute URLs).
- Affected DNN Enterprise version: 07.00.05
- Copyright 2013 ProCheckUp Ltd. All rights reserved.
Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to ProCheckUp, and provided such reproduction and/or distribution is performed for non-commercial purposes.
Any other use of this information is prohibited. ProCheckUp is not liable for any misuse of this information by any third party.