============================================ ||| Security Advisory AKLINK-SA-2008-007 ||| ============================================ CAcert - Cross Site Scripting ============================= Date released: 29.09.2008 Date reported: 26.09.2008 $Revision: 1.1 $ by Alexander Klink Cynops GmbH a.klink@cynops.de https://www.cynops.de/advisories/AKLINK-SA-2008-007.txt (S/MIME signed: https://www.cynops.de/advisories/AKLINK-SA-2008-007-signed.txt) https://www.klink.name/security/aklink-sa-2008-007-cacert-xss.txt Vendor: CAcert Product: CAcert - certificate authority providing free certificates Website: http[s]://www.cacert.org Vulnerability: non-persistent cross site scripting Class: remote Status: patched Severity: moderate (authentication information may be stolen) Releases known to be affected: cacert-20080921.tar.bz2 Releases known NOT to be affected: cacert-20080928.tar.bz2 + Background: CAcert is a certifificate authority that provides free certificates to end users based on a web-of-trust assurance model. + Overview: CAcert provides a page that allows a user to show information on a given X.509 certificate. This page was vulnerable to a cross site scripting attack, which might have led to session information of a logged-in user being compromised. + Technical details: http[s]://www.cacert.org/analyse.php contains the following code: echo "<pre>"; print_r(openssl_x509_parse(openssl_x509_read($_POST['csr']))); echo "</pre>"; which is used to dump the certificate details as parsed by the openssl_x509_parse() PHP function. No escaping whatsoever of this information is done, so an attacker can create a certificate with HTML tags, which are then shown on the page. A PoC certificate can easily be creating using OpenSSL: $ openssl req -new -x509 \ -subj "/CN=<\/pre><script>alert(document.cookies)<\/script><pre>" + Communication: * 26.09.2008: Contacted Philipp Guehring about the issue * 27.09.2008: Philipp informs me that the issue has been fixed + Solution: Has been fixed by escaping the output using htmlspecialchars(). + Credits: - Alexander Klink, Cynops GmbH (discovery)