oss-security - CVE-2015-1864: Multiple HTML and Javascript injections

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20150414214820.3a6a30de@ileemo>
Date: Tue, 14 Apr 2015 21:48:20 +0200
From: Andrew Shadura <andrew@...dura.me>
To: oss-security@...ts.openwall.com
Subject: CVE-2015-1864: Multiple HTML and Javascript injections

Hello,

We have recently discovered a security issue in Kallithea [0].

Synopsis
========

Several vulnerabilities have been found in Kallithea, allowing
attackers to inject malicious code into the administration pages.

Description
===========

HTML and Javascript injection was possible in several places in the
Kallithea UI, allowing attackers to run malicious code.

User details (first name, last name) as well as repository, repository
group and user group descriptions were pasted unfiltered into the HTML
code, thus attacker could inject their code by setting their first name
to, for example:

    <img src="/images/kallithea-logo.svg" onload="alert('Hello,
    World!');">

This would display an alert every time users administration page. Used
against a user with administrator's access, this can expose sensitive
information:

    <img src="/images/kallithea-logo.svg"
        onload="$.ajax({url:'/_admin/my_account/api_keys'}).done(function(data){
        a=new RegExp('[0-9a-z]{40}','g');alert('Your API key is:'+
        data.substr(data.search(a), 40));});">

Impact
======

As the vulnerability allows attacker to execute arbitrary code in the
user's browser, it can be used to gain access to the user's account by
stealing user's credentials, like API keys. In the case the user also
has administrator rights, it is possible for the attacker to gain full
administrator access to the Kallithea instance.

Resolution
==========

Kallithea project has fixed this issue, and issued a patch and a bugfix
release.

Users are recommended to apply the patch or to upgrade to the latest
0.2.1 release.

Affected versions
=================

The issue is currenly present in Kallithea versions before 0.2.1.

Acknowledgments
===============

Thanks to Nick High for reporting this issue.

References
==========

[0] Kallithea Project
    <https://kallithea-scm.org/>

[1] CVE-2015-1864
    <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1864>

[2] Kallithea: Security Notice CVE-2015-1864
    <https://kallithea-scm.org/security/cve-2015-1864.html>

[3] Patch for the issue
    <https://kallithea-scm.org/security/cve-2015-1864.patch>

[4] Mercurial changeset fixing the issue
    <https://kallithea-scm.org/repos/kallithea/changeset/a8f2986afc18c9221bf99f88b06e60ab83c86c55>

-- 
Cheers,
  Andrew Shadura
  on behalf of Kallithea Security Team

Content of type "application/pgp-signature" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.