full-disclosure - Re: Cross site scripting issues in s9y (CVE-2008-1386, CVE-2008-1387)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4b6ee9310804220401s3a91b773s255b0e4a6332475c@mail.gmail.com>
Date: Tue, 22 Apr 2008 12:01:09 +0100
From: n3td3v <xploitable@...il.com>
To: full-disclosure@...ts.grok.org.uk, n3td3v <n3td3v@...glegroups.com>
Subject: Re: Cross site scripting issues in s9y
	(CVE-2008-1386, CVE-2008-1387)

On Tue, Apr 22, 2008 at 11:25 AM, Hanno Böck <hanno@...eck.de> wrote:
> Two smaller issues in s9y, published here:
> http://int21.de/cve/CVE-2008-1386-s9y.html
> http://int21.de/cve/CVE-2008-1387-s9y.html
>
>
> Cross Site Scripting (XSS) in serendipity 1.3 referrer plugin, CVE-2008-1385
> References
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1385
> http://www.s9y.org/
> Description
>
> In the referrer plugin of the blog application serendipity, the referrer
> string is not escaped, thus leading to a permanent XSS.
> Example
>
> One can inject malicious javascript code with:
>
> wget --referer='http://<hr onMouseOver="alert(7)">' http://someblog.com/
>
> Workaround/Fix
>
> If you are using the referrer plugin, upgrade to 1.3.1.
> Disclosure Timeline
>
> 2008-03-18 Vendor contacted
> 2008-03-18 Vendor answered
> 2008-03-18 Vendor fixed issue in trunk/branch revision
> 2008-04-22 Vendor released 1.3.1
> 2008-04-22 Advisory published
> CVE Information
>
> The Common Vulnerabilities and Exposures (CVE) project has assigned the name
> CVE-2008-1385 to this issue. This is a candidate for inclusion in the CVE
> list (http://cve.mitre.org/), which standardizes names for security problems.
> Credits and copyright
>
> This vulnerability was discovered by Hanno Boeck of schokokeks.org webhosting.
> It's licensed under the creative commons attribution license.
>
> Hanno Boeck, 2008-04-xx, http://www.hboeck.de
>
>
>
>
> Cross Site Scripting (XSS) in serendipity 1.3 installer, CVE-2008-1386
> References
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1386
> http://www.s9y.org/
> Description
>
> The installer of serendipity 1.3 has various Cross Site Scripting issues. This
> is considered low priority, as attack scenarios are very unlikely.
>
> Various path fields are not escaped properly, thus filling them with
> javascript code will lead to XSS. MySQL error messages are not escaped, thus
> the database host field can also be filled with javascript.
> Workaround/Fix
>
> If you are doing a fresh installation of serendipity, use version 1.3.1.
>
> In general, don't leave uninstalled webapplications laying around on a public
> webspace.
> Disclosure Timeline
>
> 2008-03-21 Vendor contacted with patches
> 2008-03-21 Vendor fixed issue in trunk/branch revision
> 2008-04-22 Vendor released 1.3.1
> 2008-04-22 Advisory published
> CVE Information
>
> The Common Vulnerabilities and Exposures (CVE) project has assigned the name
> CVE-2008-1386 to this issue. This is a candidate for inclusion in the CVE
> list (http://cve.mitre.org/), which standardizes names for security problems.
> Credits and copyright
>
> This vulnerability was discovered by Hanno Boeck of schokokeks.org webhosting.
> It's licensed under the creative commons attribution license.
>
> Hanno Boeck, 2008-04-xx, http://www.hboeck.de
>
> --
> Hanno Böck              Blog:           http://www.hboeck.de/
> GPG: 3DBD3B20           Jabber/Mail:    hanno@...eck.de
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Web Application Security Awareness Day,
Its the only day in the year you don't get laughed at for releasing XSS.

Learn More
http://n3td3v.googlepages.com/home
http://lists.grok.org.uk/pipermail/full-disclosure/2008-April/061507.html

Regards,

n3td3v

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/