bugtraq - [InterN0T] LiveZilla

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20091227161950.17791.qmail@securityfocus.com>
Date: 27 Dec 2009 16:19:50 -0000
From: advisories@...ern0t.net
To: bugtraq@...urityfocus.com
Subject: [InterN0T] LiveZilla - XSS Vulnerability

LiveZilla - Cross Site Scripting Vulnerability


Version Affected: 3.1.8.3 (newest)

Info:
LiveZilla, the Next Generation Live Help / Live Chat and Live
Support System connects you to your website visitors. Use
LiveZilla to provide Live Chats and monitor your website visitors
in real-time. Convert visitors to customers - with LiveZilla!

Credits: InterN0T

External Links:
http://www.livezilla.net/


-:: The Advisory ::-
The following files would together be vulnerable to Cross Site Scripting.

1. livezilla/templates/map.tpl (lines 18-20)
var default_lat = <!--dlat-->;
var default_lng = <!--dlng-->;
var default_zom = <!--dzom-->;

2. livezilla/map.php (lines 15-28)
if(isset($_GET["lat"]))
$map = str_replace("<!--dlat-->",$_GET["lat"],$map);
else
$map = str_replace("<!--dlat-->","25",$map);

if(isset($_GET["lng"]))
$map = str_replace("<!--dlng-->",$_GET["lng"],$map);
else
$map = str_replace("<!--dlng-->","10",$map);

if(isset($_GET["zom"]))
$map = str_replace("<!--dzom-->",$_GET["zom"],$map);
else
$map = str_replace("<!--dzom-->","1",$map);


Proof of Concept: (</script><script>alert(0)</script>)
http://localhost/livezilla/map.php?lat=%3C/script%3E%3Cscript%3Ealert(%22InterN0T.net%22)%3C/script%3E

Pseudo Proof of Concept:
- Javascript functions could also have been executed inside the javascript where the vulnerable code is.

-:: Solution ::-
The following patch was supplied to the vendor:
1. livezilla/templates/map.tpl (lines 18-20)
var default_lat = "<!--dlat-->";
var default_lng = "<!--dlng-->";
var default_zom = "<!--dzom-->";

2. livezilla/map.php (lines 15-28)
if(isset($_GET["lat"]))
$map = str_replace("<!--dlat-->",htmlentities($_GET["lat"]),$map);
else
$map = str_replace("<!--dlat-->","25",$map);

if(isset($_GET["lng"]))
$map = str_replace("<!--dlng-->",htmlentities($_GET["lng"]),$map);
else
$map = str_replace("<!--dlng-->","10",$map);

if(isset($_GET["zom"]))
$map = str_replace("<!--dzom-->",htmlentities($_GET["zom"]),$map);
else
$map = str_replace("<!--dzom-->","1",$map);
We used htmlentities() since we thought that would be the best
solution. The other functions named htmlspecialchars(), urlencode()
and raw_urlencode() could have been an alternative to the above.

Disclosure Information:
- Vulnerability found 27th December
- Patch was made available 27th December
- Disclosed on InterN0T 27th December
- Vendor and Buqtraq (SecurityFocus) contacted the 27th December


All of the best,
MaXe