bugtraq - S21SEC-023 - Vignette multiple Cross Site Scripting vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1217441449.20030526161336@s21sec.com>
Date: Mon, 26 May 2003 16:13:36 +0200
From: S21SEC <vul-serv@...sec.com>
To: bugtraq@...urityfocus.com
Subject: S21SEC-023 -  Vignette multiple Cross Site Scripting vulnerabilities

###############################################################
ID: S21SEC-023-en
Title: Multiple Cross Site Scripting vulnerabilities in Vignette
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: HTML code Execution in client browsers
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-023-en.txt
Release: External
###############################################################

                                S 2 1 S E C

                           http://www.s21sec.com

            Multiple Cross Site Scripting vulnerabilities in Vignette

About Vignette
--------------

Vignette develops Content Management and Application Portal Software.

Description of vulnerability
----------------------------

Vignette Software presents multiple Cross Site Scripting vulnerabilities. (XSS)

It's possible to inyect HTML code in text variables. This variables when are showed by a Vignette Application, can execute arbitrary code in the client browser.

Vignette don't offer any protection against this kind of attacks. 

For example this way:

https://www.somesite.es/Page/1,10966,,00.html?var=<script>alert('s21sec')</script>

Even some default templates are vulnerable to this type of injection:

http://www.somestie.es/vgn/login?errInfo="%2b%20document.cookie%20%2b"

Vignette does not filter any of the "forbidden" HTML chars (<,>,",&)

This vulnerability affects all vignette applications that show input user variables without an explicit filter. Even the default error template is vulnerable.

Affected Versions and platforms
-------------------------------

This vulnerability has been tested in Vignette StoryServer 4 to Vignette V/6. But it seems that all currently avaliable versions are vulnerable.

Solution
--------

Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.

Additional information
----------------------

These vulnerabilities have been found and researched by:

 Ramon Pinuaga Cascales         rpinuaga@...sec.com

You can find the last version of this warning in:

        http://www.s21sec.com/es/avisos/s21sec-023-en.txt

And other S21SEC warnings in http://www.s21sec.com/es/avisos/