Mambo BTS

This is the bug tracking and feature request tracking system for the Mambo open source CMS project. To add a new task, or comment or vote on an existing task, please register, preferably by using the same username that you use on the forums.

Please do not open tasks for bugs in versions earlier than Mambo 4.6.5.

| Tasklist |

FS#479 - Cross Site Scripting

Attached to Project: Mambo BTS
Opened by yehg.net (yehgdotnet) - Thursday, 28 October 2010, 14:46 GMT-5
Last edited by Andres Felipe Vargas valencia (andphe) - Wednesday, 17 November 2010, 06:25 GMT-5
Task Type Defect
Category Security
Status Requires testing
Assigned To Andres Felipe Vargas valencia (andphe)
Operating System All
Severity High
Priority Normal
Reported Version 4.6.5
Due in Version 4.6.6
Due Date Undecided
Percent Complete 50%
Votes 0
Private No

Details

How to reproduce (Proof-of-concept):

1. Go to the following poc site
http://attacker.in/mambo/index.php?option=com_content&task=%22%20style=width:1000px;height:1000px;top:0;left:0;position:absolute%20onmouseover=alert%28/XSS/%29%20ns=%22%20&id=3&Itemid=32

2. Move your mouse a bit
You’ll get the XSS alert box.

For more information about XSS, see:
http://en.wikipedia.org/wiki/Cross-site_scripting

IMPACT

Attackers can compromise currently logged-in user/administrator
session and impersonate arbitrary user actions available under
/administrator/ functions.

Best regards
YGN Ethical Hacker Group
http://yehg.net/

This task depends upon

Comment by Andres Felipe Vargas valencia (andphe) - Friday, 29 October 2010, 23:39 GMT-5

Hi guys, good catch.

I already have a patch for this issue and finding new ones like this.

in file components/com_content/content.php line 26, change from: 

$task = trim( mosGetParam( $_REQUEST, 'task', '' ) );

to : 

$task = preg_replace('/\W/','', mosGetParam( $_REQUEST, 'task', '' ) );

this will eliminate all the non word chars from the task variable, please give it a try and let me know your thoughts.

Comment by yehg.net (yehgdotnet) - Saturday, 30 October 2010, 13:03 GMT-5

Ok, it's well patched. Please wait.

I have a few more issues to report including more XSS and possible SQL injection in Administrator backend. I'll report them in a few days.

Comment by yehg.net (yehgdotnet) - Sunday, 31 October 2010, 18:33 GMT-5

close this thread. I'll report other issues by new threads.

Comment by yehg.net (yehgdotnet) - Sunday, 31 October 2010, 18:33 GMT-5

Note that patch works and it fixes the flaw.

Comment by yehg.net (yehgdotnet) - Wednesday, 17 November 2010, 22:06 GMT-5

Fixed.

Comment by yehg.net (yehgdotnet) - Friday, 19 November 2010, 13:24 GMT-5

completely fixed. Close this ticket.

Loading...