LiveZilla Cross Site Scripting Vulnerability

2011.01.02
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Check Point Software Technologies - Vulnerability Discovery Team (VDT) http://www.checkpoint.com/defense/ LiveZilla Cross Site Scripting Vulnerability CVE-2010-4276 INTRODUCTION Accordingly to LiveZilla GmbH, "the Next Generation Live Help and Live Support System connects you to your website visitors. Use LiveZilla to provide Live Chats and monitor your website visitors in real-time. Convert visitors to customers - with LiveZilla! " This problem was confirmed in the following versions of the LiveZilla, other versions maybe also affected. LiveZilla released an update to fix the vulnerability. LiveZilla v3.2.0.2 CVSS Scoring System The CVSS score is: 6.4 Base Score: 6.7 Temporal Score: 6.4 We used the following values to calculate the scores: Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:N Temporal score is: E:F/RL:U/RC:C DETAILS LiveZilla is affected by Reflected Cross Site Scripting in server.php, in the &#8220;module&#8221; track which calls a vulnerable javascript function. This request: http://<server>/livezilla/server.php?request=track&livezilla=<script>alert('xss')</script> Will pass thru the following files: htdocs\livezilla\server.php htdocs\livezilla\track.php htdocs\livezilla\templates\jscript\jstrack.tpl And finally land in this excerpt of code: --- 207 208 function lz_tracking_set_sessid(_userId, _browId) 209 { 210 if(lz_session.UserId != _userId) 211 { 212 lz_session.UserId = _userId; 213 lz_session.BrowserId = _browId; 214 lz_session.Save(); 215 } 216 } 217 --- The javascript file &#8220;jstrack.tpl&#8221; is called by track.php and contains a function named &#8220;lz_tracking_set_sessid()&#8221;. This function do not sanitize data and thus an attacker can inject a malicious javascript code allowing Reflected Cross Site Script attacks against users. CREDITS This vulnerability has been brought to our attention by Ulisses Castro from Conviso IT Security company (http://www.conviso.com.br) and was researched internally by Rodrigo Rubira Branco from the Check Point Vulnerability Discovery Team (VDT). Rodrigo Rubira Branco

References:

http://www.vupen.com/english/advisories/2010/3331
http://www.securityfocus.com/bid/45586
http://seclists.org/fulldisclosure/2010/Dec/650


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top