I. Introduction

Simple Machines Forum (abbreviated as SMF) is a free Internet forum (BBS) software written in PHP.

II. Username faking via Unicode homoglyphs or duplicate spaces allows user impersonation

The forum registration process allows registering UTF8 usernames. Since Unicode contains a lot of additional symbols and some of them look very similar (or even identical) to standard ASCII characters, this allows registering a user with a name which is visually indistinguishable from an existing forum user. As an example, someone may register a user named "admiո" with the "n" replaced by the Unicode letter u+0578 (ARMENIAN SMALL LETTER VO), which looks more or less exactly like the ASCII character "n" depending on the font. This may be used in order to impersonate users e.g. in forum messages. Additionally to choosing a name which looks more or less exactly as the victim, an attacker can also steal the avatar of the victim in order to further improve the illusion.

The following page simplifies finding matching homoglyph characters for a given string:

http://www.irongeek.com/homoglyph-attack-generator.php

If the original username contains a space, user impersonation is also possible by registering the same username with two or more consecutive spaces. These spaces will be passed to all HTML pages containing the username and since web browsers ignore multiple consecutive spaces in HTML, there is no visible difference between the original and the faked username.

III. Clickjacking in SMF forum allows user-assisted remote arbitrary code execution

The forum software SMF contains no protection against clickjacking. This allows tricking a currently logged in user to do various unintended actions in the forum when the user visits a malicious website. I have a working POC exploit which requires no more than 2 clicks to a predictable location to achieve full remote code execution when exploited against a forum administrator (although I will not disclose the exact attack vector in this public advisory). A cleverly designed attack site may trick the user do these two clicks without much thinking. The first click can be achieved by displaying one of the annoying overlays which requests the user to fill out a survey, like the site on facebook or subscribe to a newsletter. Most users are conditioned to directly click on the small x on the top right of the overlay to close it. For the second click, the attack site may just not react to the first click hoping that the victim tries again. Alternatively, the site could also pretend to be a video site waiting for the user to click on the play button.

IV. Affected versions

All three vulnerabilities are present in SMF1 up to version 1.1.18 and SMF2 up to version 2.0.5. The SMF team has released updates (version 1.1.19 and 2.0.6) which fix the clickjacking problem (via an X-Frame-Options header) and the username faking possibility via multiple consecutive spaces. However, the Unicode homoglyph attack has not yet been fixed since it is not trivial to filter out all confusable characters while still allowing legitimate Unicode characters in usernames (especially if you can't use the Spoofchecker class because you have to support PHP versions below 5.4.0).

V. Credits

Jakob Lell