Yesterday we became aware of a security vulnerability in two of our sample applications: the IBuySpy Portal and the Portal Starter Kit.  We have temporarily removed the IBuySpy Portal sample download and are actively working on an update.  An updated Portal Starer Kit sample (version 1.0b) is now available which fixes the problem for that sample.


This email provides the steps to immediately fix existing sites and mitigate the potential for a malicious attack.


Who is vulnerable?


-- Any version of the VB.NET IBuySpy Portal sample configured to use html forms authentication. 


-- Any version of the VB.NET Portal Starter Kit sample configured to use html forms authentication


-- Older pre-ASP.NET V1 versions of the C# IBuySpy Portal sample (specifically for ASP.NET beta1 and beta2) configured to use html forms authentication.


This vulnerability does NOT effect:


-- The VB.NET version of the IBuySpy Portal sample configured to use Windows Authentication


-- The VB.NET version of the Portal Starter Kit sample configured to use Windows Authentication


-- The C# version of the IBuySpy Portal sample released for ASP.NET V1


-- The C# version of the Portal Starter Kit sample 


-- The IBuySpy Store sample 


-- The Community Starter Kit sample 


-- The TimeTracker Starter Kit sample 


-- The Report Starter Kit sample 


-- The Store Starter Kit sample 


Note that this problem is not an ASP.NET product vulnerability or a bug in the ASP.NET Forms Authentication feature.  Rather it is a result of a bug in how the forms authentication feature was used in the VB.NET language versions of the IBuySpy Portal and Portal Starter Kit sample applications.


What is the vulnerability?


A malicious user can login as a portal sample administrator and exploit the site by:


-- Altering text and content on the site 


-- Creating and Deleting portal users used with the sample's forms authentication system


-- Changing portal user passwords used with the sample's forms authentication system


-- Retrieving user IDs and passwords used with the sample's forms authentication system


The vulnerability specifically *does not* enable the following actions:


-- A hacker *cannot* take over the server (e.g. it does not allow hacker code to be executed on the server)


-- A hacker *cannot* access or compromise Windows usernames or passwords


-- A hacker *cannot* use the vulnerability to initiate a SQL injection attack


How to manually fix the vulnerability?


An updated version of the VB.NET Portal Starter Kit sample (version 1.0b) is now available for download.  An updated version of the VB.NET  IBuySpy Portal will be posted shortly.  If you have an existing installation of the samples, you can immediately fix the problem by performing the following steps:


To fix the SDK VB.NET versions of IBuySpy Portal and the Portal Starter Kit:


1) Open up the admin\Register.aspx file with a text editor


2) Replace the following line of code in the RegisterBtn_Click handler:




	If accountSystem.AddUser(Name.Text, Email.Text, Password.Text) Then


	with:


	If (accountSystem.AddUser(Name.Text, Email.Text, Password.Text) > -1) Then 





3) Save the file 


4) Log into your Portal site 


5) Change your admin password 


6) Optional:  Instruct registered portal users to change their passwords 


To fix the Visual Studio.NET VB.NET versions of IBuySpy Portal and the Portal Starter Kit:


1) Open up the Visual Studio Project found in the directory in which the application was installed. 


2) Open the admin\Register.aspx page 


3) Switch to the Code Behind view for the page 


4) Replace the following line of code in the RegisterBtn_Click handler




	If accountSystem.AddUser(Name.Text, Email.Text, Password.Text) Then


	with:


	If (accountSystem.AddUser(Name.Text, Email.Text, Password.Text) > -1) Then 





5) Save the file 


6) Rebuild the application (Ctrl-Shift-B) 


7) Log into your Portal site 


8) Change your admin password 


9) Optional:  Instruct registered portal users to change their passwords 


To fix C# beta versions of the IBuySpy Portal please upgrade to the latest version of the IBuySpy portal. 


We sincerely apologize for the inconvenience that this has caused,


- Scott

Scott - I hope you don't mind me adding to this - and thanks for your comprehensive clariifcation of what is and is not possible with this


Every portal install has the 'guest', 'guest' admin user installed by default - it should be a matter of course for any installation to immediately enter the admin system and remove or downgrade this user and create a specific 'unique' admin user account or accounts


There is healthy list of BugFixes available at Steve Smiths ASPSmith Site


____________________________________________________________


Q:  BUG FIX: RequiredFieldValidator in EditAnnouncements.aspx fails if Description contains a Newline Character 


 


 Q:  BUG FIX: Cannot Logout and Log Back In 


 


 Q:  BUG FIX: Using Caching Shows The Same Module In All Positions 


 


 Q:  BUG FIX: Any Registered User Can Act As Admin 


 


 Q:  BUG FIX: Can Register Multiple Users with the same Email Address 


 


 Q:  BUG FIX: Registration failure is not detected when email address is not unique 


 


 Q:  BUG FIX: ViewDocument.aspx page returning "FileName" is an invalid column. Fixed in RTM VSCS 


 


 Q:  BUG FIX: Deleting ContentType, ContentSize in Documents table by editing other fields Tested on RTM VSCS 


 


 Q:  BUG FIX: Security bug in IBS B2 


 


 Q:  BUG FIX: In the B2 version of the portal, any user can download documents from the Documents module regardless of if they can see that module or tab. Tested on RTM VSCS 1 Dependancy In-Line 


 


 Q:  BUG FIX: Why don't my DesktopModuleTitle properties get set when I set them in an event handler? 


 


 Q:  BUG FIX: Links module bug: BC30390: 'ASPNetPortal.Links.linkImage' is Private, and not accessible in this context. 


 


 Q:  BUG FIX: Documents Module Downloads Display "ViewDocument.aspx" as filename for all files uploaded to database.Confirmed Exists in v1.0 of Portal 


 


 Q:  BUG FIX: When I deploy to a root web, how do I get my links to work correctly (Request.ApplicationPath doesn't work)? 


 


 Q:  BUG FIX: PortalSettings loaded twice per request! 


 


____________________________________________________________


You can view all of these and download the code fixes necessary @ http://aspsmith.com/DesktopDefault.aspx?tabindex=2&tabid=32


PS It is great to see that the ASP.NET team are acting on this and still keeping an eye on all of us in the forum :-) 


DavidM
Various IBS Addons available at http://www.snowcovered.com

Lead Developer [vb & c#] - MCAD

When is the fixed version expected?

this did not fix my portal - i used




If Me.GetSingleUser(email).Read Then


     Return -1


End If





as the very first call in the AddUser function in security.vb


why did this not work for me? here is my sproc text - is there a different sproc now???




CREATE Procedure AddUser


(


    @Name     nvarchar(50),


    @Email    nvarchar(100),


    @Password nvarchar(20),


    @UserID   int OUTPUT


)


AS


INSERT INTO Users


(


    Name,


    Email,


    Password


)


VALUES


(


    @Name,


    @Email,


    @Password


)


SELECT


    @UserID = @@Identity


GO

Do you have an expected release date for the IBuySpy Portal Application (SDK) VB edition? 


I really need to get a copy as soon as possible.

Scott, David,


(Don't take it wrong. IBS Portal is such a unique tool.)


Excuse that naive question but...


Why aren't those bugs fixed in the new version?


Maybe some of 'em are?


According to Rob Howard:


"Updates: 


1. Fix security issue in VB versions - more details: view post 240799 


2. Store passwords encrypted in the database 


3. Updates to files to perform password encryption"


What is the process of creating Portal.msi or exe?


Can a group of programmers help you do this (just bugs not module enhancements)?
DNN skins Forum
Tressleworks modules
DNN & webhosting
IEWCtrls

Hi,


can i ask what was wrong with the code in the first place so we can avoid it in our programming?


Thank you