Claroline v.1.8.11 Cross-Site Scripting

2009.05.09
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

Author: Gerendi Sandor Attila Original Advisory: http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html Date: May 05, 2009 Package: Claroline (1.8.11) Product Homepage: http://www.claroline.net/ Versions Affected: v.1.8.11 (Other versions may also be affected) Severity: Medium Input passed to the 'Referer' header parameter when posting to '/claroline/linker/notfound.php' is not sanitized before it is returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Example: GET /claroline_1_8_11/claroline/linker/notfound.php HTTP/1.0 Accept: */* Referer: "><script>alert(123)</script><a href=" There are a couple of ways to inject arbitrary text (java script in our case) in the referer header parameter. One of the ways is using a rewrite rule on the remote attacker server. Example .htaccess file: RewriteEngine on RewriteRule ^referer/.*$ test.php [L] Where the test.php file will be the container of the /claroline_1_8_11/claroline/linker/notfound.php link. Now a request like: http://remoteatackersite/referer/?"><script>alert(123)</script><a%20href=" will return a page from wich if we call /claroline_1_8_11/claroline/linker/notfound.php we trigger the XSS. Note: For the first request browsers like IE are required (which does not automatically httpencode the get params) Status: 1. Contacted the author at: May 05, 2009 via http://forum.claroline.net/. 2. The author promptly (same day) fixed the problem, read at: http://forum.claroline.net/viewtopic.php?f=69&t=16193&p=42102#p42099


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top