bugtraq - Cross-site scripting in Samizdat 0.6.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 13 Feb 2009 14:43:46 +0200
From: Dmitry Borodaenko <angdraug@...il.com>
To: bugtraq@...urityfocus.com
Subject: Cross-site scripting in Samizdat 0.6.1

Software: Samizdat, an open publishing web application written in Ruby
Vulnerability: cross-site scripting
Vulnerable Versions: 0.6.1 and earlier
Non-vulnerable Versions: 0.6.2, Debian package 0.6.1-3lenny1
Patch: http://samizdat.nongnu.org/release-notes/samizdat-0.6.1-xss-escape-title.patch
References: CVS-2009-0359, DTSA-194-1

Description:

Samizdat 0.6.1 contains several code paths that fail to escape special HTML
characters in message title and user full name before these strings are included
in a Web page (in earlier versions, only user full name is exploitable). This
allows an attacker to perform a cross-site scripting attack by including a
specially crafted string in their full name or message title.

Test:

Login. Set your full name to a string including a special HTML character (any of
&"'<>). Publish a message with a title that includes a special character. Find
your message in the list of recent updates on the site front page, check the
HTML source to see whether the special characters were escaped as HTML entities.

Fix:

Samizdat 0.6.2 includes a fix for this vulnerability. Alternatively, a patch for
Samizdat 0.6.1 that closes this vulnerability is referenced above; it is also
recommended to apply a second patch that improves stability of the Samizdat
Sanitize module (a white-list HTML filter used to remove dangerous tags,
attributes, and CSS properties from user-submitted HTML):

http://samizdat.nongnu.org/release-notes/samizdat-0.6.1-tidy-binary.patch

Both patches are included in the Debian package version 0.6.1-3lenny1.

-- 
Dmitry Borodaenko