lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <49C6C9B4.8080802@ngenuity-is.com> Date: Sun, 22 Mar 2009 16:28:52 -0700 From: Adam Baldwin <adam_baldwin@...nuity-is.com> To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk Subject: ExpressionEngine Persistent Cross-Site Scripting nGenuity Information Services - Security Advisory Advisory ID: NGENUITY-2009-003 - ExpressionEngine Persistent Cross-Site Scripting Application: ExpressionEngine (1.6.4 (possibly earlier)-1.6.6) Vendor: EllisLab, INC Vendor website: http://www.expressionengine.com <http://www.transparent-tech.com/> Author: Adam Baldwin (adam_baldwin@...nuity-is.com) I. BACKGROUND "ExpressionEngine is a flexible, feature-rich content management system that empowers thousands of individuals, organizations, and companies around the world to easily manage their website." [1] II. DETAILS While setting a display avatar in the user control panel, avatar names are not validated for invalid input. User input is then rendered, unaltered into any browser that displays that members avatar. Here is an example of an avatar name that will display an alert to any visitor that views the users profile. chococat.gif"><script>alert('XSS')</script><div "a III. REFERENCES [1] - http://expressionengine.com/ IV. VENDOR COMMUNICATION 1.17.2009 - Vendor Notified 1.18.2009 - Initial vendor communication (details requested) 1.18.2009 - Steps to reproduce provided to vendor 1.21.2009 - Vendor response with public update "shortly" 1.22.2009 - Vendor releases 1.6.7 which addresses this vulnerability Copyright (c) 2008 nGenuity Information Services, LLC
Powered by blists - more mailing lists