bugtraq - ExpressionEngine Persistent Cross-Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <49C6C9B4.8080802@ngenuity-is.com>
Date: Sun, 22 Mar 2009 16:28:52 -0700
From: Adam Baldwin <adam_baldwin@...nuity-is.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: ExpressionEngine Persistent Cross-Site Scripting

nGenuity Information Services - Security Advisory

   Advisory ID: NGENUITY-2009-003 - ExpressionEngine Persistent Cross-Site Scripting
   Application: ExpressionEngine (1.6.4 (possibly earlier)-1.6.6)
        Vendor: EllisLab, INC
Vendor website: http://www.expressionengine.com <http://www.transparent-tech.com/>
        Author: Adam Baldwin (adam_baldwin@...nuity-is.com)

  I. BACKGROUND
     "ExpressionEngine is a flexible, feature-rich content management system
that empowers thousands of individuals, organizations, and companies
around the world to easily manage their website." [1] 

 II. DETAILS
     While setting a display avatar in the user control panel, avatar names
are not validated for invalid input. User input is then rendered, unaltered
into any browser that displays that members avatar.

Here is an example of an avatar name that will display an alert to any visitor
that views the users profile.

          chococat.gif"><script>alert('XSS')</script><div "a

III. REFERENCES
     [1] - http://expressionengine.com/

 IV. VENDOR COMMUNICATION
     1.17.2009 - Vendor Notified
     1.18.2009 - Initial vendor communication (details requested)
     1.18.2009 - Steps to reproduce provided to vendor
     1.21.2009 - Vendor response with public update "shortly"
     1.22.2009 - Vendor releases 1.6.7 which addresses this vulnerability

Copyright (c) 2008 nGenuity Information Services, LLC