- // Posted on Apr 13, 2008 by
Danny
-
Comments (42)
A fellow BlogEngine.NET user (who's name I do not know unfortunately) alerted me to an issue on my website where you could retrieve my site's user credentials by accessing the JavaScript HttpHandler via a browser and requesting my users.xml file as seen in the following screenshot. Now I would not label myself as a "security expert" by any means, but I think this issue falls under the Crazy Bad category.
I took a look at the code in the BlogEngine.Core project and found out that the issue is with the RetrieveLocalScript() method. Here's the code from BlogEngine.NET Version 1.3:
1: /// <summary>
2: /// Retrieves the local script from the disk
3: /// </summary>
4: private static string RetrieveLocalScript(string file)
5: {
6: string path = HttpContext.Current.Server.MapPath(file);
7: string script = null;
8:
9: using (StreamReader reader = new StreamReader(path))
10: {
11: script = reader.ReadToEnd();
12: HttpContext.Current.Cache.Insert(file, script, new CacheDependency(path));
13: }
14:
15: return script;
16: }
After adding a temporarily fix to not allow my user credentials to be served to the browser (I know - I am a stickler), I decided to do a little research. I attempted to access Mads Kristensens blog's users.xml file (in no way to be malicious) to see if his website handled this issue. Sure enough, I received a "no access" security exception - see that error here. If you follow Mads' blog you would also know that he is running the latest beta code of BlogEngine.NET. I decided to search around in the BlogEngine.NET CodePlex project site for a discussion/fix and what I found is that the JavaScriptHandler.cs file received a bug fix today at 9:30am (1.3.029) - check it out here. Below is the fixed RetrieveLocalScript() method. You will notice that only JavaScript files are served now in lines 6-9.
1: /// <summary>
2: /// Retrieves the local script from the disk
3: /// </summary>
4: private static string RetrieveLocalScript(string file)
5: {
6: if( !file.EndsWith( ".js", StringComparison.OrdinalIgnoreCase ) )
7: {
8: throw new System.Security.SecurityException( "No access" );
9: }
10:
11: string path = HttpContext.Current.Server.MapPath(file);
12: string script = null;
13:
14: using (StreamReader reader = new StreamReader(path))
15: {
16: script = reader.ReadToEnd();
17: HttpContext.Current.Cache.Insert(file, script, new CacheDependency(path));
18: }
19:
20: return script;
21: }
Well I would say that is a fairly simple fix for users that have downloaded the full-source code edition of BlogEngine.NET. What about the users that do not have access to their BlogEngine.Core project?! I am glad you asked! I'm offering a clean version (no other changes except this bug fix from version 1.3) of the BlogEngine.Core DLL. Troy Goode is utilizing this DLL on his live site over at http://squaredroot.com in case you would like to see it in action first!
Update: The patched downloads are available over at BlogEngine.NET - http://dotnetblogengine.net/post/Critical-Security-Patch-Available.aspx.
Hope that helps!
[dnk:http://dannydouglass.com/post/2008/04/BlogEngine-and-the-JavaScript-HttpHandler-Serious-Security-Issue.aspx]
$DNK$
- Tags: bugs, news
- Categories: ASP.NET | Blogging