Информационная безопасность
[RU] switch to English


Дополнительная информация

  Ежедневная сводка ошибок в Web-приложениях (PHP, ASP, JSP, CGI, Perl )

  [Full-disclosure] Advanced Guestbook version 2.4.2 Directory Traversal Vulnerability

  [Full-disclosure] Advanced Guestbook version 2.4.2 Multiple XSS Attack Vulnerabilities

  pfa CMS v6.0 (index.php repinc) Remote File Include Vulnerability

  fipsCMS v2.1 Remote SQL injection Vulnerability

From:ciri_(at)_virtuax.be <ciri_(at)_virtuax.be>
Date:8 мая 2007 г.
Subject:OTRS <= 2.0.x XSS/XSRF

---------------------------------------------------------------------------------

|               ____   ____.__         __                                       |
|               \   \ /   /|__|_______/  |_ __ _______  ___                     |
|                \   Y   / |  \_  __ \   __\  |  \__  \ \  \/  /                |
|                 \     /  |  ||  | \/|  | |  |  // __ \_>    <                 |
|                  \___/   |__||__|   |__| |____/(____  /__/\_ \                |
|                                                     \/      \/                |
|                             Security without illusions                        |
|                                  www.virtuax.be                               |
|                                                                               |
---------------------------------------------------------------------------------



                         Application: OTRS
                 Vulnerable Versions: <= v2.0.x
                       Vulnerability: XSS/XSRF

                              Vendor: http://www.otrs.org
                       Vendor Status: Notified

                               Found: 07-05-2007
                 Public Release Date: 07-05-2007
                       Last modified: 07-05-2007
                              Author: ciri
                              E-mail: ciri[a.t]virtuax[d.o.t]be
        
      reference: http://www.virtuax.be/advisories/Advisory5-07052007.txt

=================================================================================


Shouts to the VirtuaX Crew & Community!

=================================================================================




I. Background
-------------

"OTRS is an Open source Ticket Request System with many features to manage customer
telephone calls and e-mails. The system is built to allow your support, sales,
pre-sales, billing, internal IT, helpdesk, etc. department to react quickly to
inbound inquiries"
                                                             by otrs.org


II. Vulnerablity
----------------

OTRS is vulnerable to a XSS/XSRF. It is possible to inject code into the
Subaction parameter. Authentication is required to reach the page, but a
non-authenticated user will be asked to login and the attack will still be carried
out. XSRF is ofcourse also possible in this case.

IIa. Affected Versions
----------------------

OTRS 2.0.4 was tested and appears to be vulnerable. I've tested version 2.2.0 and
it doesn't seem to be vulnerable anymore.

III. PoC
--------

http://server/otrs/index.pl?Action=AgentTicketMailbox&Subaction=<img src=
https://server/otrs/images/Standard/new-message.png onLoad=javascript:alert('hello');>

Copyright 2007 by ciri from Virtuax.be All rights reserved. 1

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород