Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
OpenCms Input Validation Flaws Permit Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1022682 |
|
SecurityTracker URL: http://securitytracker.com/id/1022682
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Aug 7 2009
|
Impact:
Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): 7.5.0
|
Description:
A vulnerability was reported in OpenCms. A remote user can conduct cross-site scripting attacks.
Several scripts do not properly filter HTML code from user-supplied input before displaying the input. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the OpenCms software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A remote user can also inject arbitrary HTML into various frames to conduct phishing attacks.
Katie French reported these vulnerabilities.
|
Impact:
A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the OpenCms software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.opencms.org/ (Links to External Site)
|
Cause:
Input validation error
|
Underlying OS:
Linux (Any), UNIX (Any), Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: 6 Aug 2009 19:25:52 -0000
Subject: OpenCms (7.5.0) - Vulnerability: Cross-Site Scripting, Phishing
|
Application: OpenCms
Version: 7.5.0
Hardware: Tomcat/Oracle
Vulnerability: Cross-Site Scripting, Phishing Through Frames,
Application Error
Overview:
Various URL's within the deployed OpenCms application version 7.5.0 are
open to attacks, including Cross-Site Scripting, Phishing Through Frames
and Application Error. Some of these attacks allow injection of scripts
into a parameter in the request. The application should filter out such
hazardous characters from user input.
Example follows:
Vulnerable URL (from the OpenCms VFS):
/opencms/opencms/system/modules/org.opencms.workplace.help/jsptemplates/
help_head.jsp?&homelink=>"'><script>alert("This%20site%20has%20been%20co
mpromised")</script>
Results:
Insertion of the script into the homelink parameter successfully embeds
the script in the response and is executed once the page is loaded into
the user's browser (i.e. vulnerable to Cross-Site Scripting)
Below find the complete list of vulnerable URL's (all paths are relative
to the OpenCms VFS). All issues are of High risk.
/opencms/opencms/system/modules/org.opencms.workplace.help/elements/sear
ch.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): query
Vulnerability(s): Cross-Site Scripting
/opencms/opencms/system/modules/org.opencms.workplace.help/jsptemplates/
help_head.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): homelink
Vulnerability(s): Cross-Site Scripting, Phishing Through Frames
/opencms/opencms/system/workplace/commons/preferences.jsp
Remediation: Verify that parameter values are in their expected ranges
and types. Do not output debugging error messages and exceptions
Parameter(s): tabdicopyfilemode, tabdicopyfoldermode,
tabdideletefilemode
Vulnerability(s): Application Error
/opencms/opencms/system/workplace/commons/property.jsp
Remediation: Filter out hazardous characters from user input
Parameter: resource
Vulnerability(s): Cross-Site Scripting
/opencms/opencms/system/workplace/commons/publishproject.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): title, cancel, dialogtype, framename, progresskey,
projected, projectname, publishsiblings, relatedresources, subresources
Vulnerability(s): Cross-Site Scripting, Phishing Through Frames, SQL
Injection
/opencms/opencms/system/workplace/commons/publishresource.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s):
Vulnerability(s): Cross-Site Scripting
/opencms/opencms/system/workplace/commons/unlock.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): title
Vulnerability(s): Cross-Site Scripting, Phishing Through Frames
/opencms/opencms/system/workplace/editors/editor.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): resource
Vulnerability(s): Cross-Site Scripting
/opencms/opencms/system/workplace/editors/dialogs/elements.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): elementlanguage, resource, title
Vulnerability(s): Cross-Site Scripting, Phishing Through Frames
/opencms/opencms/system/workplace/locales/en/help/index.html
Remediation: Filter out hazardous characters from user input
Parameter(s): workplaceresource
Vulnerability(s): Phishing Through Frames
/opencms/opencms/system/workplace/views/admin/admin-main.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): path
Vulnerability(s): Cross-Site Scripting
/opencms/opencms/system/workplace/views/explorer/contextmenu.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): acttarget
Vulnerability(s): Cross-Site Scripting, Phishing Through Frames
/opencms/opencms/system/workplace/views/explorer/explorer_files.jsp
Remediation: Filter out hazardous characters from user input
Parameter(s): mode
Vulnerability(s): Cross-Site Scripting
Katie French
CGI Federal
12601 Fair Lakes Circle
Fairfax,VA 22033
FFX: (703) 227-5642
RRB: (202) 564-0475
|
|
Go to the Top of This SecurityTracker Archive Page
|
