Security in Open Source Web Content Management Systems
Total Page：16
File Type：pdf, Size：1020Kb
Internet Security Security in Open Source Web Content Management Systems Users of Web content management systems (WCMSs) lack expert knowledge of the technology itself, let alone its security issues. Complicating this, WCMS vulnerabilities are attractive targets for attackers, leaving the applications and their nonexpert users open to exploitation. MICHAEL any Web applications, such as those for Among CMSs, MEIKE e-commerce or collaboration, use out- we distinguish Trusted Bytes of-the-box Web content management between those focused on the Web and the enter- systems. WCMSs let users who don’t prise. Historically, the content management concept JOHANNES Mhave in-depth development knowledge easily build originated from organizations’ efforts to manage SA M ETINGER a customized Web site with broad functionality. For Web content.2 The enterprise content management AND ANDREAS small- and medium-sized enterprises, open source (ECM) concept reaches beyond Web content man- WIESAUER WCMSs offer an easy to use, low-cost alternative to agement, however, addressing management of “the Johannes commercial software. However, these systems raise convergence of all front-end applications and devices Kepler significant security issues. with back-end document/file management systems University Security is critical to any Internet-connected in- and databases.”2 ECM involves not only technical formation system; vulnerabilities can create serious systems, but also “the strategies, tools, processes and consequences for system users and operators, includ- skills an organization needs to manage its informa- ing stolen credit-card data or customer information. tion assets over their lifecycle.”3 Because of their wide usage, open source WCMSs In contrast, according to current understanding, are a desirable target for attackers. Once mali- a WCMS supports creating and publishing content cious users discover a vulnerability in a particular structured in Web formats, such as HTML, XHTML, WCMS, they can carry out attacks on many—if not XML, and PDF. A WCMS also lets users review, ap- all—of the applications built with it. Open source prove, and archive content, and (sometimes) offers WCMS developers are aware of this and have estab- version control.4 Using such functions, users can lished security teams, Internet forums, and security implement an editorial process that comprises several tips for users. Still, the security of such systems re- roles with varying privileges, including authors, re- mains unclear. To shed light on it, we’ve selected viewers, and consumers. two popular open source WCMSs based on PHP: An organization might, for example, use a WCMS Hypertext-Preprocessor (PHP) and analyzed them to build corporate Web sites, online shops, or com- for well-known vulnerabilities. munity portals. The major advantage of a WCMS is that it lets site creators modify content without having Web Content to edit code or possess other specialized knowledge. Management Systems Organizations typically store the content in databases Heidi Collins defines content management as main- and publish, modify, and remove it using graphical taining, organizing, and searching across information user interfaces. sources, both structured (databases) and unstruc- A WCMS can be divided by front- and back-end tured (documents, emails, video files, and so on).1 functionality. The front end presents available content 44 COPUBLISHED BY THE IEEE COMPUTER AND RELIABILITY SocIETIES ■ 1540-7993/09/$26.00 © 2009 IEEE ■ JULY/AUGUST 2009 Internet Security to consumers, who typically don’t have permission to user data by placing manipulated input forms on change or edit the content. However, front-end users pages managed by a WCMS. They can also exploit are sometimes granted special permissions, such as to WCMS vulnerabilities to lure users to replicated submit comments on articles. Web sites that mimic an official site, such as a bank, Publishing and editing is done via the application’s and gather data accordingly. back end, which is the workplace for authors and re- • Code execution. Attackers can exploit WCMS vul- viewers. Authors typically enter their content using a nerabilities to load files or programs containing de- rich text editor, which creates HTML, XHTML, or fective code onto a Web server. They can do this by XML markup. They render this markup by applying using even simple graphic files. The WCMS must style sheets—such as CSS or XSL—which authors can carefully verify inputs because such an attack can adapt to suit their design needs. harm not only the WCMS itself, but also other ap- plications on the same server. WCMS Security • Spam. Here, Web crawlers scan the Internet for valid In software systems, security vulnerabilities are de- email addresses and send spam accordingly. Attack- fects at either the design or implementation level. ers can also use an application vulnerability to send Gary McGraw defines a bug as an implementation- spam through the application’s server, turning it into level software problem and a flaw as a problem that’s a spam relay server. “certainly instantiated in software code, but is also present on the design level.”5 Examples of flaws in- As these examples show—and Michael Howard clude error-handling problems and broken or illogi- and David LeBlanc note—Web applications in gen- cal access control. Bugs and flaws create risks, which eral, and WCMSs in particular, operate in a hostile are the probability that a flaw or a bug will impact environment.9 the software’s purpose: risk = probability × impact.5 Software defects might exist for a long time before at- Attacks and Countermeasures tackers actually exploit them. Attackers use various attack patterns, which are blue- Networking applications—especially those ex- prints for creating a particular type of attack. Each posed to the Internet—are much more vulnerable to attack consists of several phases of discovery and ex- threats than conventional stand-alone desktop applica- ploitation; the pattern generalizes the steps so that tions as many more users can access them, and access other malicious users can successfully attack the appli- is much harder to control. Often, attacks over the In- cation. Attack patterns can include many dimensions, ternet are almost fully automated, and many tools let such as timing, resources required, and techniques.10 people with even minor technical knowledge (known Because of a WCMS’s wide application area, the as “script kiddies”) exploit vulnerabilities. possible harm due to attacks is manifold. If a WCMS is used as an e-commerce site, attackers might obtain Key Vulnerabilities confidential customer data, such as credit-card infor- As a Web application, a WCMS is an attractive target mation. If the site’s owner had failed to properly se- for attackers and a major source of security vulner- cure the WCMS, an attack disclosure could lead to abilities.6 Threats affect one or more security aspects. claims for damages, as well as a general loss of cus- According to several experts,7,8 Web application tomer confidence. threats include In other cases, attackers might gather user informa- tion, such as addresses and profiles, and sell the infor- • Data manipulation. This type of attack violates data mation to the site’s competitors. A WCMS can also be integrity, and the resulting data loss or perversion sabotaged and rendered inaccessible. This could, for can have serious consequences. Common attack example, lead to a decline in sales. techniques here include parameter manipulation On corporate WCMS Web sites, attackers might and SQL injection. utilize security leaks to upload malicious code and • Accessing confidential data. Here, attackers access off- harm a company’s IT infrastructure. Attackers might the-record data using techniques such as structured also alter the company’s Web site content by, for ex- Query Language (SQL) injection and cross-site ample, adding dubious and suspect content to tarnish scripting (XSS). the company’s reputation. • Phishing. This attack gathers confidential data—such To be considered secure, a Web application must as bank account information, social security num- ensure bers, or passwords—by contacting users under false pretences via email and luring them to Web sites • authentication, by verifying that entities or people where they’re encouraged to enter personal data. are who they pretend to be; For example, attackers might use XSS to gather • confidentiality, by hiding information from unau- www.computer.org/security 45 Internet Security such estimates. Additionally, UK Linux World named Webman Joomla the Best Linux/Open Source Project in 2006 MMBase (www.joomla.org/announcements/general-news/ Java 2165-joomla-wins-again-at-uk-linuxworld.html). OpenCMS That same year, Joomla also won Packt Publishing’s Drupal WebGUI Open Source CMS Award, and Drupal took second Mambo Typo3 MySQL place (see www.packtpub.com/article/open-source Mason PHP HTML Perl CSS -content-management-system-award-winner Joomla XML Metadot Portal-Server -announced). PHPNuke Joomla and Drupal have many similarities. They both use LAMP—that is, Linux, Apache, MySQL, Python Plone ZMS and PHP. They both also use XML files to store con- figuration parameters and CSS for design and layout, and have similar functionality. Nonetheless, Joomla and Drupal have key differences that make them in- Figure 1. Open source Web content management systems and related teresting from a security-comparison perspective, in- technologies. All systems, regardless of implementation, use Web cluding different architectures and implementations. standards, such as HTML and CSS, and relational databases. Joomla Joomla is a derivative of Mambo, a popular PHP- thorized people; based WCMS, and has been used to build roughly 5 • integrity, by preventing unauthorized people from million Web sites worldwide. The system emphasizes modifying, withholding, and deleting information; ease of use, so even nontechnical users can create, edit, and and maintain content. Joomla also offers many out-of- • availability, by performing operations according to the-box Web site components, including forums and their purpose over time.11 chat components, calendars, and blogging software.