RETIRED: Wiki Web Help Insecure Cookie Authentication Bypass Vulnerability

Bugtraq ID:	44152
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 17 2010 12:00AM
Updated:	Oct 19 2010 08:19AM
Credit:	FuRty
Vulnerable:	Richard Bondi Wiki Web Help 0.3.3 Richard Bondi Wiki Web Help 0.2.8 Richard Bondi Wiki Web Help 0.2.7 Richard Bondi Wiki Web Help 0.2.6 Richard Bondi Wiki Web Help 0.2.5 Richard Bondi Wiki Web Help 0.2.4 Richard Bondi Wiki Web Help 0.2.3 Richard Bondi Wiki Web Help 0.2.2 Richard Bondi Wiki Web Help 0.2.1 Richard Bondi Wiki Web Help 0.2
Not Vulnerable:

RETIRED: Wiki Web Help Insecure Cookie Authentication Bypass Vulnerability

Wiki Web Help is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application; this may aid in further attacks.

Wiki Web Help versions 0.3.3 and prior are vulnerable.

NOTE: This BID is being retired. The vulnerability can not be exploited as discussed. According to the vendor a crafted cookie is not enough to authenticate to the application.

RETIRED: Wiki Web Help Insecure Cookie Authentication Bypass Vulnerability

Attackers can exploit this issue through a browser.

The following example cookie data is available:

javascript:document.cookie="loggedon=[VictimNICK];path=/"; javascript:document.cookie="level=admin;path=/";

RETIRED: Wiki Web Help Insecure Cookie Authentication Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

RETIRED: Wiki Web Help Insecure Cookie Authentication Bypass Vulnerability

References:

• Product Homepage (Richard Bondi)
  
• Vendor Homepage (Richard Bondi)