[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJfirPmVcNiZtTuN-4ZBB=YuKSaibf7-xexmOsmy8hfNZcAL9w@mail.gmail.com>
Date: Thu, 26 Sep 2013 20:01:45 +0200
From: Rafael Luque <rafael.luque.leiva@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: Javamelody blind XSS through X-Forwarded-For header
Javamelody [1] includes a blind XSS vulnerability. An attacker could
provide an specially-crafted "X-Forwarded-For" HTTP header while visiting a
Java web application monitored with Javamelody that would lead to arbitrary
HTML or Javascript execution in the context of the administrator user
monitoring the panel of active sessions in the application.
The versions affected are the last one 1.46 and all the previous that
include the session monitoring panel feature.
The issue has been reported to the project [2] but whithout response by now.
The proof of concept may use the own Javamelody online demo:
1. Access the demo site [3] using a fake X-Forwarded-For header like the
following: <script>alert('xss')</script>
2. Then visit the Javamelody sessions monitoring page at [4] and you should
see the Javascript running.
Can you allocate a CVE identifier for this?
Thank you && Regards,
Rafael Luque
[1] https://code.google.com/p/javamelody/
[2] https://code.google.com/p/javamelody/issues/detail?id=346
[3] http://demo.javamelody.cloudbees.net/
[4] http://demo.javamelody.cloudbees.net/monitoring?part=sessions
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
