lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 21 Jul 2006 10:28:45 -0400 From: <harbl@...hmail.com> To: <full-disclosure@...ts.grok.org.uk> Cc: Subject: Blackboard Academic Suite 6.2.23 +/-: Persistent cross-site scripting vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I. Affected Software Blackboard Academic Suite 6.2.3.23 Prior or newer versions may also be affected. Vendor website: http://www.blackboard.com/ II. Impact Subjective: Severe Objective: Privilege escalation III. Vulnerability There is a persistent/stored/second-order cross-site scripting vulnerability within the testing functionality of Blackboard Academic Suite 6.2.23. The vulnerability can be used by attackers who have unprivileged user accounts to escalate their privileges within one or more Blackboard courses, or, with luck, gain system- wide Blackboard administrative privileges. Privilege escalation is possible by using the vulnerability to steal "session_id" cookies from users whose accounts have higher privileges than the attacker's account. An additional attack opportunity may exist if an attacker has identified a remotely-exploitable vulnerability in the javascript interpreter of the target user's web browser. Blackboard Academic Suite 6.2.23 attempts to defend against this vulnerability by using client-side javascript to remove any javascript code entered into test questions. Trusting the client to validate input is a bad idea. In this case, the attacker can defeat the validation routine by simply disabling javascript in his/her web browser. To exploit the vulnerability when using Mozilla Firefox to access a Blackboard Academic Suite 6.2.3.23 system: 1. As a user with the course instructor role, create a test in any course and add an essay question to the test. Deploy the test in a course area that is available to students in the course. 2. Login to the course as a user who has the student role in the course selected for step 1. Access the course; you should now see the course's entry point page. 3. Turn off javascript in Firefox. 4. Navigate to and click the link for the test created in step 1. Begin the test. 5. The essay question created in step 1 should appear. Click the "HTML" radio button below the question's response box. Enter javascript code into the response box. Submit the test attempt. 6. Logout. 7. Turn on javascript in Firefox. 8. Login as the course instructor. 9. Access the course selected in step one. In the course's control panel, click "Gradebook", then click the name of the test created in step one, and then click "View Attempt Details". 10. Find that the javascript code entered in step 5 is executed in the target’s browser in the security context of the Blackboard website being accessed. IV. Solution There is no known solution at this time. V. Timetable The vendor has been aware of this vulnerability for at least two and one-half months. -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wpwEAQECAAYFAkTA5U8ACgkQPVniVs9rtmDV0AP+NVaWE5MZMV/lIhiWli/HDMhwQamP iRANNCgRjv48UmV/xFS8zaKvZb88Pyhcpjh+H68pt+Ouuhy97tM9mmnpGqM5Gzy2eQTt pD310vlWQ6Q0/F4vFVerWH+Irn58ME3yqbJXfIjmngK3UYG6YddYyMdxaYcwSJfvD6Pw 0K1hyRc= =38Ug -----END PGP SIGNATURE----- Concerned about your privacy? Instantly send FREE secure email, no account required http://www.hushmail.com/send?l=480 Get the best prices on SSL certificates from Hushmail https://www.hushssl.com?l=485 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists