RPCMS CVE Submission

0001.jpg

0002.jpg

CVE_submission.md

RPCMS CVE Submission

Official Website: https://www.rpcms.cn/, https://github.com/ralap-z/RPCMS/

Version v1.8: https://github.com/ralap-z/rpcms/tree/74c49c4df0e0ac6b187def23bb2dadef40990dce (updated on 12th July 2021, latest version)

Audited on 20th July, 2021, credit to Zhang Zhiyi.

---

The source code can also be downloaded in this gist (rpcms_1.8.zip) folder

For better understanding of the problems, in-line comments are added in the key parts of source code after // sign.

Vulnerability 1: Admin User Registration

When API is enabled, the registered user is normal user by default. However, user can manually set the role to be admin to register as admin user.

//system/api/Member.class.php
	public function register(){
		$data=array();
		$data['username']=!empty(input('post.username')) ? strip_tags(input('post.username')) : '';
		$data['password']=!empty(input('post.password')) ? strip_tags(input('post.password')) : '';
		$data['nickname']=!empty(input('post.nickname')) ? strip_tags(input('post.nickname')) : $data['username'];
		$data['role']=!empty(input('post.role')) ? strip_tags(input('post.role')) : 'member';// normal user access by default
		$data['email']=input('post.email');
		$data['phone']=input('post.phone');
		$data['status']=0;
		$data['isCheck']=1;
...
		$data['password']=psw($data['password']);
		$res=Db::name('user')->insert($data);
		Cache::update('user');
		Hook::doHook('api_member_register',array($res));
		$this->response($res,200,'注册成功！');
	}

Trigger the vulnerability (0002.jpg)

Vulnerability 2: Stored XSS1

In the following code, $title is displayed directly without sanitizing, resulting in stored XSS. Specifically, it can be triggered at |0| and |1|.

//system/index/Author.class.php
public function index(){
    if(!isset($this->params[1]) || empty($this->params[1])){
        redirect($this->App->baseUrl);
    }
    $data=explode('_',$this->params[1]);
    $page=isset($data[1]) ? intval($data[1]) : 1;
    $user=Cache::read('user');
    if(is_numeric($data[0])){
        $userId=intval($data[0]);
    }else{
        $user2=array_column($user,NULL,'nickname');
        $userId=isset($user2[$data[0]]) ? $user2[$data[0]]['id'] : '';
    }
    if(empty($userId) || !isset($user[$userId])){
        rpMsg('当前作者不存在！');
    }
    $LogsMod=new LogsMod();
    $logData=$LogsMod->page($page)->order($this->getLogOrder(array('a.isTop'=>'desc')))->author($userId)->select();
    $logData['count']=$user[$userId]['logNum'];
    $title=$user[$userId]['nickname'];// nickname from the user
    $pageHtml=pageInationHome($logData['count'],$logData['limit'],$logData['page'],'author',$userId);
    $this->setKeywords();
    $this->setDescription('关于作者'.$title.'的一些文章整理归档'); //|0|
    $this->assign('title',$title.'-'.$this->webConfig['webName']); //|1|
    $this->assign('listId',$userId);
    $this->assign('listType','author');
    $this->assign('logList',$logData['list']);
    $this->assign('pageHtml',$pageHtml);
    return $this->display('/list');
}

It can be seen that variable nickname can be used by the attacker. By tracing the usage of nickname before loading into database:

function update user password: updatePsw

public function updatePsw(){
    $nickname=input('post.nickname');
    $password=input('post.password');
    $password2=input('post.password2');
    if(empty($nickname)){
        return json(array('code'=>-1,'msg'=>'昵称不可为空'));
    }
    if(!empty($password) && $password != $password2){
        return json(array('code'=>-1,'msg'=>'两次密码输入不一致'));
    }
    $updata=array('nickname'=>$nickname);
    if(!empty($password)){
        $updata['password']=psw($password);
    }
    if($res=Db::name('user')->where('id='.$this->user['id'])->update($updata)){
        Cache::update('user');
        return json(array('code'=>200,'msg'=>'修改成功','data'=>!empty($password) ? 1 : 0));
    }
    return json(array('code'=>-1,'msg'=>'修改失败，请稍后重试'));
}

It can be seen that nickname variable is not properly sanitized, taking the direct post input. A stored XSS can be found here.

Trigger the vulnerability: (0001.jpg)

## Vulnerability 3: Stored XSS

Similar to vulnerability 2, after enabling API, users can update to variable nickname directly through API without strip tags. Once nickname is updated, a stored xss can be triggered when user view articles.

//system/api/Member.class.php
public function post(){
    $this->chechAuth(true);
    $nickname=input('post.nickname'); //no filtering
    $password=input('post.password');
    $password2=input('post.password2');
    if(empty($nickname)){
        $this->response('',401,'昵称不可为空');
    }
    if(!empty($password) && $password != $password2){
        $this->response('',401,'两次密码输入不一致');
    }
    $updata=array('nickname'=>$nickname);
    if(!empty($password)){
        $updata['password']=psw($password);
    }
    if($res=Db::name('user')->where('id='.self::$user['id'])->update($updata)){
        Cache::update('user');
        Hook::doHook('api_member_post',array(self::$user));
        $this->response('',200,'修改成功');
    }
    $this->response('',401,'修改失败');
}

rpcms_v1.8.zip