Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  Pligg CMS 2.0.2 - Stored XSS

  Arbitrary file deletion and multiple XSS vulnerabilities in pfSense

  [USN-2539-1] Django vulnerabilities

  Reflected XSS Vulnerability in XSS In Manage Engine Device Expert

From:Filippo Cavallarin <filippo.cavallarin_(at)_segment.technology>
Date:11 мая 2015 г.
Subject:DokuWiki persistent Cross Site Scripting



Advisory ID: SGMA15-001
Title: DokuWiki persistent Cross Site Scripting
Product: DokuWiki
Version: 2014-09-29c and probably prior
Vendor: www.dokuwiki.org
Vulnerability type: Persistent XSS
Risk level: Medium
Credit: Filippo Cavallarin - segment.technology
CVE: N/A
Vendor notification: 2015-03-18
Vendor fix: 2015-03-19
Public disclosure: 2015-03-23


Details

DokuWiki version 2014-09-29c (and probably prior) is vulnerable to Persistent Cross Site Scriptng in the admin page.

An attacker may use this vulnerability to execute javascript in the context of a logged admin user.
Since the vulnerable page has forms with the CSRF token (the same for all requests), a full backend compromise may be possible.

To successfully exploit this vulenrability an attacked must:
1. have an account on the target site
2. trick and admin to visit a link or to edit user account


Proof of concept:

1. change your account real name to:
my name" autofocus onfocus="alert('code executed')

2. login as admin and try to edit the user profile from User Manager


Solution

Apply the latest hotfix from vendor's site


References
https://www.dokuwiki.org/
https://github.com/splitbrain/dokuwiki/issues/1081





Filippo Cavallarin
https://segment.technology

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород