=== Security Advisory ===
Webtrees 1.5.1 - Cross-Site-Scripting
------------------------------------------------------------
Affected Version
================
Webtrees 1.5.1
Problem Overview
================
Technical Risk: low
Likelihood of Exploitation: medium
Vendor: Webtrees Team
Reported by: Eric Sesterhenn <snakebyte@gmx.de>
Advisory updates: http://www.rusty-ice.de/advisory/advisory_2014001.txt
Advisory Status: Public
Problem Impact
==============
While taking a quick look at the web interface, a
XSS issue when a malicious map parameter is supplied.
Problem Description
===================
The problem manifests in modules_v3/googlemap/wt_v3_street_view.php line 311
where the map GET parameter is embedded into javascript without escaping.
The same issue appears with the GET parameter streetview in line 312.
The issue can be be easily tested:
http://localhost/webtrees-master/modules_v3/googlemap/wt_v3_street_view.php?map=%27%22;%20alert%28%22XSS%22%29;%20b=%22
Temporary Workaround and Fix
============================
Apply the following patch:
--- wt_v3_street_view.php.orig 2014-01-03 17:37:40.328119432 +0100
+++ wt_v3_street_view.php 2014-01-04 10:56:05.288790531 +0100
@@ -308,8 +308,8 @@ function initialize() {
} // end init
-var mapbutt = "<?php echo $_GET['map']; ?>";
-var svbutt = "<?php echo $_GET['streetview']; ?>";
+var mapbutt = <?php echo json_encode($_GET['map']); ?>;
+var svbutt = "<?php echo json_encode($_GET['streetview']); ?>";
function toggleStreetView() {
var toggle = panorama.getVisible();
if (toggle == false) {
@@ -373,8 +373,8 @@ google.maps.event.addDomListener(window,
<div id="toggle">
<form name="myForm" title="myForm">
<?php
- $map = $_GET['map'];
- $reset = $_GET['reset'];
+ $map = htmlentities($_GET['map']);
+ $reset = htmlentities($_GET['reset']);
echo '<input id="butt1" name ="butt1" type="button" value="', $map, '" onclick="toggleStreetView();"></input>';
echo '<input id="butt2" name ="butt2" type="button" value="', $reset, '" onclick="resetview();"></input>';
?>
History
=======
03.01.2014 - Issue detected
03.01.2014 - Vendor notified
03.01.2014 - Vendor response, code rewritten
04.01.2014 - Proposal of more complete patch
10.02.2014 - fixed version released (1.5.2)
10.02.2014 - Advisory released
