lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 14 Nov 2010 17:40:35 -0700
Subject: vBulletin 4.0.8 - Persistent XSS via Profile Customization

vBulletin - Persistent Cross Site Scripting via Profile Customization

Versions Affected: 4.0.8 (3.8.* is not vulnerable.)

Content publishing, search, security, and moreó vBulletin has it all.
Whether itís available features, support, or ease-of-use, vBulletin offers
the most for your money. Learn more about what makes vBulletin the
choice for people who are serious about creating thriving online communities.

External Links:

Credits: MaXe (@InterN0T)

-:: The Advisory ::-
vBulletin is prone to a Persistent Cross Site Scripting vulnerability within the
Profile Customization feature. If this feature is not enabled the vulnerability 
does not exist and the installation of vBulletin is thereby secure.

Within the profile customization fields, it is possible to enter colour codes,
rgb codes and even images. The image url() function does not sanitize user
input in a sufficient way causing vBulletin to be vulnerable to XSS attacks.

[1] Private Reflected XSS:
An attacker can inject scripts in a simple way, which is only visible to the attacker.

Proof of Concept:
url(</script><img src="x:x" onerror="alert(String.fromCharCode(73,110,116,101,114,78,48,84,11))" />)
(This is only visible to the attacker when he or she is logged in, and browsing his or her own profile.)

[2] Global Reflected XSS:
An attacker can inject malicious CSS data executing javascript, which is then visible
to anyone browsing the user profile. Even guests visiting the malicious user profile.

Proof of Concept: (IE6 only, may not work in IE7+ and FF)

Please note that some of these strings may be too long to be injected. However a
blog entry at Exploit-DB and a video on YouTube will be released very soon.

-:: Solution ::-
Turn off profile customization immediately for users able to customize their profile!
When a security patch has been provided by the vendor, enable this feature again.

Disclosure Information:
- Vulnerability found and researched: 11th November 2010
- Vendor (vBulletin Solutions / IB) contacted: 11th November
- Disclosed to Exploit-DB, Bugtraq and InterN0T: 14th November


Powered by blists - more mailing lists