XOOPS Portal Input Validation Flaw in IMG Tags Lets Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1005281 |
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 24 2002
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): RC3.0.4
|
Description: An input validation vulnerability was reported in the XOOPS portal software. A remote user can cause arbitrary javascript to be executed on an XOOPS user's computer.
It is reported that a remote user can insert javascript in a news post, as shown:
<IMG SRC="javascript:[javascript]">
When
the news post is viewed by a target user, arbitrary scripting code will be executed by the target user's browser. The code will
originate from the site running XOOPS and will run in the security context of that site. As a result, the code will be able to access
the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by
the target user via web form to the site, or take actions on the site acting as the target user.
The vendor has reportedly been
notified.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with an XOOPS site, access
data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution: No solution was available at the time of this entry. The vendor is reportedly planning to fix the flaw in a future release.
The author of the report suggests disabling HTML in each message as a workaround.
|
Vendor URL: www.xoops.org/modules/news/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: das@hush.com
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 24 Sep 2002 06:58:50 -0700
From: das@hush.com
Subject: Xoops RC3 script injection vulnerability
|
--------------------------------------------
| Xoops RC3 script injection vulnerability |
--------------------------------------------
PROGRAM: Xoops
VENDOR: http://www.xoops.org/
VULNERABLE VERSIONS: RC3.0.4,possibly previous versions
IMMUNE VERSIONS: no immune current versions
SEVERITY: high
Product Description
===================
"XOOPS is a dynamic OO (Object Oriented) based open source portal script written in PHP. XOOPS i
s the ideal tool for developing small
to large dynamic community websites, intra company portals, corporate portals, weblogs and much more
." dixit vendor website.
It can be found at http://www.xoops.org
Tested version
==============
Xoops RC3.0.4, current version (maybe previous versions are also vulnerables).
Description
============
The problem appears when a user post a news, a vulnerability exists in Xoops RC3 that allow a typical
IMG attack against visitors
:
<IMG SRC="javascript:[javascript]">
The problem
===========
A badly disposed member can propose a news containing code (for une news containing code sample of a
new vulnerability for example)
and if webmasters or moderators don't take care, they will approve the news.
Vendor status
=============
I wanted to inform someone from Xoops.org but the website wasn't available, so I informed the French
team. They weren't aware of this
problem so they transmitted it to the Dev Team. The Dev Team had already located the vulnerability w
hich is not specific to Xoops
but with much of scripts.
In future version, a new filter will be inserted in the textsanitizer to avoid even more this risk.
Solution
========
There's no secure release of Xoops, so the unique solution is, at this moment to disable Html in each
post, to avoid the problem.
Links
=====
Vendor: http://www.xoops.org
Vendor French team: http://www.frxoops.org
This vulnerability's orginal paper can be found here: http://www.echu.org/modules/news/article.php?st
oryid=95
------------------------------
David Suzanne (aka dAs)
das@echu.org
http://www.echu.org
Get your free encrypted email at https://www.hushmail.com
|
|
