Ceilidh Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1006391 |
|
SecurityTracker URL: http://securitytracker.com/id/1006391
|
|
CVE Reference:
CVE-2003-1531
(Links to External Site)
|
Updated: Jul 7 2008
|
Original Entry Date: Mar 27 2003
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
|
Exploit Included: Yes
|
Version(s): 2.70 and prior versions
|
Description:
Security Corporation reported an input validation flaw in the Ceilidh bulletin board software. A remote user can conduct cross-site scripting attacks against bulletin board users.
It is reported that the 'testcgi.exe' script does not filter HTML code from user-supplied input when displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running Ceilidh and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit URL is provided:
http://[target]/cgi-bin/testcgi.exe?[hostile_code]
The vendor has reportedly been notified.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running Ceilidh, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.lilikoi.com/index_main.html (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
BeOS, Linux (Any), MacOS, UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 27 Mar 2003 15:37:36 +0100
Subject: [SCSA-013] Cross Site Scripting vulnerability in testcgi.exe
|
________________________________________________________________________
Security Corporation Security Advisory [SCSA-013]
________________________________________________________________________
PROGRAM: Ceilidh
HOMEPAGE: http://www.lilikoi.com
VULNERABLE VERSIONS: 2.70 and prior
________________________________________________________________________
DESCRIPTION
________________________________________________________________________
"Ceilidh is a Web-based threaded discussion engine that features
automatic text to HTML conversion, file attachment, e-mail
notification, automatic message expiration, multiple levels of
security and much more."
(direct quote from http://www.lilikoi.com)
DETAILS & EXPLOITS
________________________________________________________________________
¤ Cross Site Scripting :
A exploitable bug was found on Ceilidh which cause script
execution on client's computer by following a crafted url.
This kind of attack known as "Cross-Site Scripting Vulnerability" is
present in testcgi.exe file, an attacker can input specially crafted
links and/or other malicious scripts.
- Exploits :
http://[target]/cgi-bin/testcgi.exe?[hostile_code]
The hostile code could be :
[script]alert("Cookie="+document.cookie)[/script]
(open a window with the cookie of the visitor.)
(replace [] by <>)
SOLUTIONS
________________________________________________________________________
No solution for the moment.
VENDOR STATUS
________________________________________________________________________
The vendor has reportedly been notified.
LINKS
________________________________________________________________________
- http://www.security-corp.org/index.php?ink=4-15-1
- Version Française :
http://www.security-corporation.com/index.php?id=advisories&a=013-FR
------------------------------------------------------------------------
Grégory Le Bras aka GaLiaRePt | http://www.Security-Corporation.com
------------------------------------------------------------------------
|
|
