Time to alert “Sparkasse Bank Macedonia” before someone hack them.

Time to alert “Sparkasse Bank Macedonia” before someone hack them..

Again the same vulnerable CMS in one of the EUROPE’S famous bank in Macedonia. I published the FCKEDITOR hack before one and a half years a go. And like I see that there is no any positive wish to fix this RISK that is coming with the FCKEDITOR. Unfortunately a famous bank is also using this EDITOR for their web site  SPARKASSE.COM.MK of Republic of Macedonia which have the exploitable version of FCKEDITOR.

The POC the proof of concept is very simple:

 

site:MK inurl:WEBARCHITECT   and you will see the address http://www.sparkasse.com.mk/

and the second step is just to paste the code:

/FCKeditor/editor/filemanager/browser/default/browser.html?Type=/../&Connector=connectors/aspx/connector.aspx

This will activate the Directory Traversal Attack

http://en.wikipedia.org/wiki/Directory_traversal_attack

Conclusion:

The result of this attack is full ROOT HACK with UPLOADER to the Read/Write enabled folders, where attacker can upload a shell and to take over the whole server. So like we can see this hack is very easy and can be conducted from any attacker which have a general knowledge form hacking techniques.

 

Remediation:

The remediation for this attack is to update the exploitable FCKEDITOR version to new one or to change the FCKEDITOR folders permission.

 

Kind regards,

Senad Aruc

Senior Security Specialist

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

w

Connecting to %s

Create a free website or blog at WordPress.com.

Up ↑

%d bloggers like this: