oss-security - Re: CVE Request:Vanilla Forums 2.0.16 <= Cross Site Scripting Vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2025608634.170697.1296160616674.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Thu, 27 Jan 2011 15:36:56 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley <coley@...re.org>
Subject: Re: CVE Request:Vanilla Forums 2.0.16 <= Cross Site
 Scripting Vulnerability

Please use CVE-2011-0526. Thanks.

-- 
    JB

----- Original Message -----
> ===========================================
> Vanilla Forums 2.0.16 <= Cross Site Scripting Vulnerability
> ===========================================
> 
> 
> 1. OVERVIEW
> 
> The Vanilla Forums 2.0.16 and lower versions were vulnerable to Cross
> Site Scripting.
> 
> 
> 2. BACKGROUND
> 
> Vanilla Forums are open-source, standards-compliant, customizable
> discussion forums.
> It is specially made to help small communities grow larger through SEO
> mojo, totally customizable social tools,
> and great user experience. Vanilla is also built with integration at
> the forefront, so it can
> seamlessly integrate with your existing website, blog, or custom-built
> application.
> 
> 
> 3. VULNERABILITY DESCRIPTION
> 
> The 'Target' parameter was not properly sanitized after user logs in,
> which allows attacker to conduct Cross Site Scripting attack.
> An attacker could prepare a link in a forum post that includes a link
> to a file which seems to require authentication.
> Upon logging in, user will get XSSed.
> 
> 
> 4. VERSIONS AFFECTED
> 
> 2.0.16 and lower
> 
> 
> 5. PROOF-OF-CONCEPT/EXPLOIT
> 
> http://vanilla/index.php?p=/entry/signin&Target=javascript:alert(document.cookie)//http://
> 
> 
> 6. SOLUTION
> 
> Upgrade to Vanilla Forums 2.0.17 or higher
> 
> 
> 7. VENDOR
> 
> Vanilla Forums Development Team
> http://vanillaforums.org/
> 
> 
> 8. CREDIT
> 
> This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
> Ethical Hacker Group, Myanmar.
> 
> 
> 9. DISCLOSURE TIME-LINE
> 
> 2010-12-14: notified vendor
> 2011-01-18: vendor released fix
> 2011-01-27: vulnerability disclosed
> 
> 
> 10. REFERENCES
> 
> Original Advisory URL:
> http://yehg.net/lab/pr0js/advisories/[vanilla_forums-2.0.16]_cross_site_scripting
> What XSS Can Do:
> http://yehg.net/lab/pr0js/view.php/What%20XSS%20Can%20Do.pdf
> XSS FAQs: http://www.cgisecurity.com/articles/xss-faq.shtml
> XSS (wiki): http://en.wikipedia.org/wiki/Cross-site_scripting
> XSS (owasp): http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
> CWE-79: http://cwe.mitre.org/data/definitions/79.html
> 
> 
> #yehg [2011-01-27]

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.