aushack.com - Vulnerability Advisory
Squiz - My Source and My Source Matrix
"MySource Matrix is the newest version of the popular MySource CMS,
purpose built for enterprise level installations. It boasts all the
features of high-end systems such as highly configurable workflow,
a powerful integrated search engine, intuitive front-end editing, true
rollback and much more."
MySource Matrix 3.8 and below, MySource 2.x.
MySource Matrix may be used as an unauthorised HTTP proxy (and XSS).
Low - An anonymous user may use the MySource based website as a proxy.
Additionally, proxied bandwidth may be at great financial expense.
A function of the software 'sq_remote_page_url' allows inclusion of remote
content in the body of the website.
... where '$page' is a valid CMS reference, e.g. 'about_us'.
This will return the Google website, encapsulated in the header
and footer HTML of the www.mysource-example.com.au site.
Remote PHP inclusion does not appear to be possible (returns % hex value).
One could write a script to enable a world wide anonymous proxy array.
The vendor does not consider this a vulnerability. Newer versions of the
software include a function 'sq_content_src' to hide the URL (Base64),
in addition to use of a string whitelist to permit inclusion, for example:
if whitelist = http://www.trust-content.com/index?id=*, where * = <wildcard>
ok = http://www.trust-content.com/index?id=1234
bad = http://www.trust-content.com/index?ref=1234
Note that whilst the URL is Base64 encoded, this does not necessarily mean
that whitelists are used. Future releases may be proxied via:
Patrick Webster ( patrick (at) aushack (dot) com [email concealed] )
27-Apr-2006 - Discovered during audit, Squiz notified shortly after.
07-Jun-2006 - Sent security patch query to Squiz developers.
09-Jun-2006 - Squiz response - use whitelist function.
22-Sep-2006 - Public disclosure.