Silverstripe <= v2.3.4 XSS vulnerabilities

2010.04.30
Credit: Moritz Naumann
Risk: Low
Local: No
Remote: Yes
CVE: CVE-2010-1593
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Silverstripe CMS, <http://silverstripe.org/>, version 2.3.4 and lower (and its unreleased 2.4 branch), is vulnerable to two Cross Site Scripting issues. 1. The comment posting mechanism of Silverstripe ('PostCommentForm') fails to properly sanitize the 'CommenterURL' parameter. This allows for persistent injection of HTML or javascript code within existing HTML tags. 2. The forum module is vulnerable to a reflective XSS issue caused by the search script failing to properly sanitize input to the 'Search' parameter. When invoking this URL: SILVERSTRIPESITE/forums/search/?Search=%22%20onmouseover=%22javascript:a lert%280%29;%22 trying to reorder the search results will trigger execution of the injected javascript code. According to its quickly responding developers, Silverstripe version 2.3.5 fixes both issues: http://groups.google.com/group/silverstripe-announce/browse_thread/threa d/f51749342eee9456 Relevant SCM changesets: http://open.silverstripe.org/changeset/97034 http://open.silverstripe.org/changeset/97070 http://open.silverstripe.org/changeset/97073 http://open.silverstripe.org/changeset/97074 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iEYEAREKAAYFAktZ9qEACgkQn6GkvSd/BgzVmACfaNiygTiaMy59QygEu0xeZ93S KzsAoIIQA7krAVdNycjXdh7EaIMUiVk+ =9I4y -----END PGP SIGNATURE-----

References:

http://www.silverstripe.org/security-releases/
http://www.securityfocus.com/bid/37923
http://open.silverstripe.org/changeset/97074
http://groups.google.com/group/silverstripe-announce/browse_thread/thread/f51749342eee9456
http://xforce.iss.net/xforce/xfdb/55839
http://xforce.iss.net/xforce/xfdb/55838
http://www.securityfocus.com/archive/1/archive/1/509139/100/0/threaded
http://secunia.com/advisories/38347
http://secunia.com/advisories/38290
http://osvdb.org/61923
http://osvdb.org/61921
http://open.silverstripe.org/wiki/ChangeLog/2.3.5
http://archives.neohapsis.com/archives/fulldisclosure/2010-01/0450.html


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top