Created attachment 836487 [details] Auth bypass fix

Description of problem:

In Piranha web UI configuration, only GET requests require authentication (via <Limit GET>...</Limit> in config file), it's possible to display some page by sending POST requests.

Version-Release number of selected component (if applicable): piranha-0.8.6-4.el6.x8664

Steps to Reproduce:

1. GET requests require authentication as expected:

curl -I http://192.168.1.34:3636/secure/control.php HTTP/1.1 401 Authorization Required Date: Fri, 13 Dec 2013 20:43:35 GMT Server: Apache/2.2.15 (CentOS) PHP/5.3.3 WWW-Authenticate: Basic realm="access to the piranha web GUI" Connection: close Content-Type: text/html; charset=iso-8859-1

2. The same request but with POST:

curl -d'' -I http://192.168.1.34:3636/secure/control.php <HTML> <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML Strict Level 3//EN">

<HEAD> <TITLE>Piranha (Control/Monitoring)</TITLE> <STYLE TYPE="text/css"> [...] [...] [...] </FORM> </TD></TR></TABLE> </BODY>

Actual results: Admin page displayed

Expected results: Admin page denied

Additional info: A fix is attached

A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers to execute arbitrary web scripts or HTML via creating a page and injecting a crafted payload into the Markdown blocks.

A stored cross-site scripting (XSS) vulnerability in the Page Settings module of Piranha CMS v12.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Excerpt field.