full-disclosure - [FD] CVE-2015-0955 - Stored XSS in Adobe Experience Manager (AEM)

Open Source and information security mailing list archives

Date: Tue, 23 Feb 2016 13:41:22 +0000
From: Alexandre Herzog <Alexandre.Herzog@...c.ch>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
 "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] CVE-2015-0955 - Stored XSS in Adobe Experience Manager (AEM)

#############################################################

#

# COMPASS SECURITY ADVISORY http://www.csnc.ch/ 

#############################################################

#

# CSNC ID:          CSNC-2015-011

# CVE ID :            CVE-2015-0955

# Product:          Adobe Experience Manager (AEM) [1]

# Vendor:           Adobe [2]

# Subject:           Stored Cross-Site Scripting (XSS) Vulnerability

# Risk:                  Important

# Effect:              Exploitable by Authenticated AEM Users

# Author:            Damian Pfammatter (damian.pfammatter@...c.ch)

# Date:                 February 23rd 2016

#

#############################################################

Introduction:

-------------

Adobe Experience Manager (AEM) is an enterprise-grade web content management
solution for building

websites, mobile apps and forms [1].

Security Analysts of Compass Security Schweiz AG [3] discovered a stored
Cross-Site Scripting (XSS)

vulnerability, which allows executing JavaScript code in a victim's context,
potentially resulting

in a number of different attack scenarios. For instance, the identified
vulnerability could be used

by a malicious AEM user to publish content in the name of another AEM user.

Affected Versions:

------------------

AEM 6.1.0

Technical Description:

----------------------

Authenticated users in AEM, having permissions to create new folders, may
place malicious JavaScript

code into a folder's title field. Once such a folder gets deleted, the
injected code is executed in

the context of the user deleting the folder. The vulnerability arises due to
improper output

encoding of folder titles in the Deletion popup dialog.

Amongst others, this stored XSS vulnerability could potentially be leveraged
by a low-privileged AEM

user to escalate its privileges. For example, a user having content
management permissions only

could create a folder, which when deleted by another, higher privileged AEM
user, could assign him

administrative privileges. Other type of XSS-related attacks - such as for
instance redirecting

other AEM users to websites abusing browser vulnerabilities to gain local
access - might be

possible.

Hotfix:

-------

Adobe has released a security hotfix (8651) [4] to address this issue.

Timeline:

---------

2015-10-29: Vulnerability discovered

2015-11-23: Initial vendor notification

2015-12-01: Vendor confirmed security issue

2016-02-09: Vendor released security fix & guidance to its customers [4]

2016-02-23: Public disclosure

References:

-----------

[1]:
https://www.adobe.com/marketing-cloud/enterprise-content-management.html

[2]: https://www.adobe.com

[3]: http://www.csnc.ch/advisories

[4]:
https://helpx.adobe.com/security/products/experience-manager/apsb16-05.html

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5735 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives