bugtraq - [S21SEC-047] Fotoware Fotoweb 8.0 Cross Site Scripting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20160729124108.69AF.56D96C99@s21sec.com>
Date: Fri, 29 Jul 2016 12:41:17 +0200
From: S21sec Vulnerability Research <vulns@...sec.com>
To: bugtraq@...urityfocus.com
Subject: [S21SEC-047]  Fotoware Fotoweb 8.0 Cross Site Scripting 

############################################################## 

                    - S21Sec Advisory - 
                   - S21SEC-047-en.txt  -

############################################################## 

     Title:  Fotoware Fotoweb 8.0 Cross Site Scripting (XSS) 
        ID:  S21sec-047-en 
  Severity:  Low 
   History:  May.2016  Vulnerability discovered 
             June.2016 Vendor contacted 
             July.2016 Vendor patch acknowledge.
     Scope:  Cross Site Scripting XSS 
 Platforms:  Any 
    Author:  Miguel A. Hernandez / Departamento Auditoria S21sec.
    
   Release:  Public 


[ SUMMARY ] 

Fotoweb is an enterprise grade Digital Asset Management System (DMS).
A DMS provides a central repository of pictures and media files. 

Unfiltered user-supplied data can lead a reflected XSS vulnerability.
This allows an attacker to execute arbitrary JavaScript in the context of the
browser of a victim if the victim clicks on an attacker supplied link or visits
an attacker controlled website.

[ AFFECTED VERSIONS ] 

This vulnerability has been tested and found working on version 8.0.715.5753


[ DESCRIPTION ] 

An insufficient input validation allows JS code injection in the 
parameter 'to' in login page. Example: 

http://fotowebserver/fotoweb/views/login?to=/fotoweb/%22;}%20else%20{%20alert%28%22S21sec%20XSS%22%29;%20}%20if%20%28inIframe%28%29%29%20{%20var%20relleno=%22


[ WORKAROUND ] 

The reported vulnerability has been reviewed by Fotoware development team.
This issue is addressed in FotoWeb 8 Feature Release 8. 

[ ACKNOWLEDGMENTS ] 

This vulnerability has been found and researched by: 

   - Miguel A. Hernandez [ Departamento de Auditoria S21sec ]

We would like to acknowledge the assistance of Fotoware:   
   
   - John Fredrik Engeland [ Fotoware Support Manager ]

[ REFERENCES ] 

* Fotoware 
 http://fotoware.com

* S21sec 
  http://www.s21sec.com 

* S21sec Blog 
  http://blog.s21sec.com