bugtraq - XSS Vulnerability in JpGraph 3.0.6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4B312D62.5040001@sas.upenn.edu>
Date: Tue, 22 Dec 2009 15:34:42 -0500
From: Martin Barbella <barbella@....upenn.edu>
To: full-disclosure@...ts.grok.org.uk
Cc: bugtraq@...urityfocus.com
Subject: XSS Vulnerability in JpGraph 3.0.6

XSS Vulnerability in JpGraph 3.0.6

Discovered by Martin Barbella <barbella@....upenn.edu>

Description of Vulnerability:
-----------------------------
JpGraph is an object oriented library for PHP that can be used to create
various types of graphs which also contains support for client side
image maps.

The GetURLArguments function for the JpGraph's Graph class does not
properly sanitize the names of get and post variables, leading to a
cross site scripting vulnerability.


Systems affected:
-----------------
This has been confirmed in version 3.0.6 of JpGraph's free release.
Previous versions and the professional versions may be affected as well.


Impact:
-------
When a user is tricked into clicking on a malicious link or submitting a
specially crafted form, the injected code travels to the vulnerable web
server, which reflects the attack back to the user’s browser. The
browser then executes the code because it came from a "trusted" server.
(From OWASP: http://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29)


Mitigating factors:
-------------------
The vulnerability seems to be exploitable only in cases where client
side image maps are used.


Proof of concept:
-----------------
This can be demonstrated in the csim_in_html_ex1.php example provided
with jpgraph (as well various other csim examples) as shown below.

http://site/csim_in_html_ex1.php?"/><script>alert('XSS')</script>=arbitrary


Solution:
---------

The following patch can be applied to jpgraph.php to correct the
vulnerability.

--- jpgraph.php.orig    2009-11-14 14:45:01.000000000 -0500
+++ jpgraph.php    2009-11-14 14:55:34.000000000 -0500
@@ -1286,11 +1286,11 @@
         while( list($key,$value) = each($_GET) ) {
             if( is_array($value) ) {
                 foreach ( $value as $k => $v ) {
-                    $urlarg .= '&amp;'.$key.'%5B'.$k.'%5D='.urlencode($v);
+                    $urlarg .=
'&amp;'.urlencode($key).'%5B'.urlencode($k).'%5D='.urlencode($v);
                 }
             }
             else {
-                $urlarg .= '&amp;'.$key.'='.urlencode($value);
+                $urlarg .= '&amp;'.urlencode($key).'='.urlencode($value);
             }
         }
 
@@ -1301,11 +1301,11 @@
         while( list($key,$value) = each($_POST) ) {
             if( is_array($value) ) {
                 foreach ( $value as $k => $v ) {
-                    $urlarg .= '&amp;'.$key.'%5B'.$k.'%5D='.urlencode($v);
+                    $urlarg .=
'&amp;'.urlencode($key).'%5B'.urlencode($k).'%5D='.urlencode($v);
                 }
             }
             else {
-                $urlarg .= '&amp;'.$key.'='.urlencode($value);
+                $urlarg .= '&amp;'.urlencode($key).'='.urlencode($value);
             }
         }