bugtraq - Persistent XSS in Kayako Support Suite

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200905062134.n46LYx8b027222@www3.securityfocus.com>
Date: Wed, 6 May 2009 15:34:59 -0600
From: pen-test@...odo.com
To: bugtraq@...urityfocus.com
Subject: Persistent XSS in Kayako Support Suite

##########################################################
# Comodo Group
#
# Vendor : Kayako Infotech Ltd.
# URL : http://www.kayako.com/
# Version : Kayako SupportSuite < 3.04.10
##########################################################

We've discovered a persistent XSS vulnerability in Kayako Support Suite Version 3.04.10.  Although other similar XSS and SQL injection vectors such GET requests/URLs and other vulnerable POST fields have been previously published, we've found no reference to this particular one.  Current versions are not vulnerable, however this particular vector has not been previously disclosed.

In verion 3.04.10 (and probably others) an attacker (authenticated staff member) can inject code simply by creating a support ticket and including a javascript in the ticket notes.  The script will execute in the context of the browser of any staff member who views the ticket allowing the attacker to steal cookies, spoof web pages, etc.  

BKz
LPIC, Sec+, OSCP
http://www.comodo.com