Improper Authentication in Burden

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxxx>]

Advisory ID: HTB23192
Product: Burden
Vendor: Josh Fradley
Vulnerable Version(s): 1.8 and probably prior
Tested Version: 1.8
Advisory Publication:  December 18, 2013  [without technical details]
Vendor Notification: December 18, 2013 
Vendor Patch: December 18, 2013 
Public Disclosure: January 8, 2014 
Vulnerability Type: Improper Authentication [CWE-287]
CVE Reference: CVE-2013-7137
Risk Level: High 
CVSSv2 Base Score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in application 
authentication mechanism in Burden, which can be exploited by remote 
non-authenticated attacker to gain administrative access to the vulnerable 
application.


1) Improper Authentication in Burden: CVE-2013-7137

The vulnerability exists due to insufficient authentication when handling 
"burden_user_rememberme" cookie parameter. A remote unauthenticated user can 
set "burden_user_rememberme" cookie to "1" and gain administrative access to 
the application. 

The exploitation example below shows HTTP GET request that grants 
administrative privileges to the user:


GET /login.php HTTP/1.1

Cookie: burden_user_rememberme=1;


The cookie can be also changed using a browser plugin such as Firebug for 
FireFox.

-----------------------------------------------------------------------------------------------

Solution:

Update to Burden 1.8.1

More Information:
https://github.com/joshf/Burden/releases/tag/1.8.1

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23192 - 
https://www.htbridge.com/advisory/HTB23192 - Improper Authentication in Burden.
[2] Burden - https://github.com/joshf - Burden is a full featured task 
management app written in PHP.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[5] ImmuniWeb® - http://www.htbridge.com/immuniweb/ - is High-Tech Bridge's 
proprietary web application security assessment solution with SaaS delivery 
model that combines manual and automated vulnerability testing.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.