Date: Sun, 8 Mar 2015 02:14:26 +0200
From: "Mohamed A. Baset" <symbian2010@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] OpenKM Platform Remote Reflected Cross Site Scripting

# Exploit Title: OpenKM Platform Remote Reflected Cross Site Scripting
# Google Dork: N/A
# Date: 18-11-2014
# Exploit Author: Mohamed Abdelbaset Elnoby (@SymbianSyMoh)
# Vendor Homepage: http://www.openkm.com/en
<http://s.bl-1.com/h/mPQYWnX?url=http://www.openkm.com/en>/
# Software Link: http://www.openkm.com/en/download-english.html
<http://s.bl-1.com/h/mPQZb9Z?url=http://www.openkm.com/en/download-english.html>
# Version: All versions < 6.4.19 (built 23338)
# Tested on: All OS
# CVE : N/A

Hi,

My Name is Mohamed Abdelbaset Elnoby aka ( @SymbianSyMoh ) an Information
Security Evangelist from Egypt.

I want to report a major security vulnerabilities in OpenKM Platform, Let's
know firstly what is OpenKM :: Open Knowledge Management

OpenKM is a Free/Libre document management system that provides a web
interface for managing arbitrary files. OpenKM includes a content
repository, Lucene indexing, and jBPM workflow. The OpenKM system was
developed using Java technology.
In 2005 two developers involved in open source technologies and expertise
with some commercial document management solutions (Sharepoint, Documentum,
Hummingbird, among others) like Excalibur search engine or Kofax OCR engine
decided to start an open source project based on high level technologies to
build a document management system that they decided to call OpenKM.
"-Wikipedia"

Ref: http://en.wikipedia.org/wiki/OpenKM
<http://s.bl-1.com/h/mPQZhbc?url=http://en.wikipedia.org/wiki/OpenKM>

-Vulnerability: Remote Reflected/Stored Cross Site Scripting with no remote
interaction
-Severity: Very Critical
-Vulnerable Parameter(s)/Input(s): Tasks
-Info: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
<http://s.bl-1.com/h/mPQZmzf?url=https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29>
-Impact: Remote Admin or Users Full Account Takeover with no interaction.

-Attack Scenario:
1. User#1 "Attacker" : Creates a task with a vulnerable name and assign it
to another User/Admin "Targeted Victim".
2. User#2 "Victim" : Got Exploited with the vulnerable Task made by the
Attacker "User#1" since the Task notification will automatically appears to
the assigned user side "Victim" also the notification popup displays the
vulnerable task name and the victim will be exploited with no interactions.


-PS: This is the most critical attack you will see on OpenKM platform
because it will work remotely against users even with the same scenario
described in the report you can steal/execute a JS in the Administrator's
session.
-PoC Video: http://youtu.be/3jBQFAAq23k

Thanks

-- 
*Best Regards**,**,*


*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist
& Bug Bounty Hunter.
LinkedIn
<http://s.bl-1.com/h/mPQZqNh?url=https://www.linkedin.com/in/symbiansymoh>Curriculum
Vitae <http://s.bl-1.com/h/mPQZwnk?url=http://goo.gl/cNrVpL>
<http://s.bl-1.com/h/mPQZ09m?url=https://www.linkedin.com/in/symbiansymoh>
Facebook
<http://s.bl-1.com/h/mPQZ4Zo?url=https://fb.com/symbiansymoh>Twitter
<http://s.bl-1.com/h/mPQZ9yq?url=https://twitter.com/symbiansymoh>

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists