bugtraq - XSS (Cross Site Scripting) in Social CRM & Community Solutions powered by Lithium in Knowledge base section

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201603240556.u2O5ukpk016506@sf01web1.securityfocus.com>
Date: Thu, 24 Mar 2016 05:56:46 GMT
From: netizen01k@...il.com
To: bugtraq@...urityfocus.com
Subject: XSS (Cross Site Scripting) in Social CRM & Community Solutions
 powered by Lithium in Knowledge base section

* Exploit Title: XSS (Cross Site Scripting) in Social CRM & Community Solutions powered by Lithium in Knowledge base section
* Discovery Date: 2016/02/19
* Public Disclosure Date: 2016/03/24
* Exploit Author: Imran Khan
* Contact: netizen01k [at] gmail.com
* Vendor link: http://www.lithium.com/
* Tested on:  Firefox 45.0
* Category: webapps

Product Description

========================================================================

Lithium Technologies’ Social CRM platform is offers SaaS services like forums, blogs, private messaging and Knowledge Base.

 PoC

========================================================================
A Reflected XSS (or Non-Persistent) cross site scripting web vulnerability has been discovered in Lithium Technologies’ Social CRM web-application.The vulnerability allows remote attackers to inject own malicious script codes to the application-side of the vulnerable modules context.The vulnerability is located in the knowledge base section for example https://community.XXX.com/t5/forums/searchpage/tab/tkb?. The attack vector of the vulnerability is located on the application-side and the request method to inject is GET. The execution of the inserted payload occurs in the search module.Below are more details.

1).To list down the customers using the Community solutions provided by Lithium
navigate to google.com and type the query /t5/forums/searchpage/tab/tkb

2). Now open one of the Knowledge base page for instance,
https://community.XXX.com/t5/forums/searchpage/tab/tkb?

3) under the search tag enter the XSS payload

"--> </script><svg/onload=';alert(document.cookie);'>
and then click on search

Timeline

========================================================================

2016/02/16 - Issues discovered and reported Lithium

2016/02/17 – Vendor confirmed the vulnerability

2016/02/24 – Follow up with vendor, No reply came back

2016/03/22 – Vendor informs the fix roll out.

2016/03/24 – Public Disclosure

Solution

========================================================================

 The fix is already rolled out by Lithium