nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-003 - ExpressionEngine Persistent Cross-Site Scripting Application: ExpressionEngine (1.6.4 (possibly earlier)-1.6.6) Vendor: EllisLab, INC Vendor website: http://www.expressionengine.com <http://www.transparent-tech.com/> Author: Adam Baldwin (adam_baldwin_at_ngenuity-is&#46;com) I. BACKGROUND "ExpressionEngine is a flexible, feature-rich content management system that empowers thousands of individuals, organizations, and companies around the world to easily manage their website." [1] II. DETAILS While setting a display avatar in the user control panel, avatar names are not validated for invalid input. User input is then rendered, unaltered into any browser that displays that members avatar. Here is an example of an avatar name that will display an alert to any visitor that views the users profile. chococat.gif"><script>alert('XSS')</script><div "a III. REFERENCES [1] - http://expressionengine.com/ IV. VENDOR COMMUNICATION 1.17.2009 - Vendor Notified 1.18.2009 - Initial vendor communication (details requested) 1.18.2009 - Steps to reproduce provided to vendor 1.21.2009 - Vendor response with public update "shortly" 1.22.2009 - Vendor releases 1.6.7 which addresses this vulnerability Copyright (c) 2008 nGenuity Information Services, LLC