full-disclosure - Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <AANLkTimZfwF16zfzGCr4ygZG2UG59Ocd6ge1y+xE3YBx@mail.gmail.com>
Date: Thu, 26 Aug 2010 02:45:33 +0800
From: YGN Ethical Hacker Group <lists@...g.net>
To: moderators@...db.org, full-disclosure@...ts.grok.org.uk, 
	bugtraq@...urityfocus.com, bugs@...uritytracker.com, vuln@...unia.com, 
	secalert@...urityreason.com, news@...uriteam.com, vuln@...urity.nnov.ru
Subject: Joomla! Component com_bc Cross Script Scripting
	(XSS) Vulnerability

=====================================================================
 Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability
=====================================================================

1. OVERVIEW

The Joomla! Component com_bc was vulnerable to Cross Script Scripting
(XSS) Vulnerability.

2. PRODUCT DESCRIPTION

The Joomla! Component com_bc is a widely-used Blastchat chat server
component designed for website communities
from the smallest personal websites to the huge megasites who desire
to provide their members and visitors
with a superb chat experience. BlastChat has currently been serving
chat to over 50.000+ websites.

3. VULNERABILITY DESCRIPTION

The Joomla! Component com_bc does not properly escape parameters:-
ctask, bcItemid, lang, nlang , rid, rsid, sec_code, template, and
usergid.
This leads to Cross Site Scripting vulnerability. For more information
about this kind of vulnerability, see OWASP Top 10 - A2, WASC-8 and
CWE-79: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting').

4. VERSIONS AFFECTED

Versions Not Available (reason: Closed-source/Commercial Product)

5. PROOF-OF-CONCEPT/EXPLOIT

Vulnerable URL-1:
index2.php?option=com_bc&no_html=1&task=load&ctask=enter&d=1&url=[victim_url]&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&&sec_code=[]&time_key=2010-08-11%2003:46:00&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=20&detaching=1

Vulnerable URL-2:
index2.php?option=com_bc&no_html=1&task=client&ctask=enter&d=0c39e7&url=[victim_url&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&sec_code=[]&time_key=2010-08-11%2018:45:20&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=7
Affected parameters: d , no_html, ctask, bcItemid, lang, nlang , rid,
rsid, sec_code, template, usergid

http://yehg.net/lab/pr0js/advisories/joomla/com_bc_xss(rid).jpg

6. IMPACT

As this is a multi-user chat application "component", the impact of
XSS is huge, ranking from cookie theft to mass client exploits.

7. SOLUTION

Reported vulnerabiltiy was fixed at 08-15-2010. It is now supposed to be safe.
It is suggested that any web sites that use this component ask the
vendor for the updated version.

8. VENDOR

Blastchat
http://www.blastchat.com

9. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.

10. DISCLOSURE TIME-LINE

08-11-2010: discovered vulnerability
08-11-2010: notified vendor
08-15-2010: vendor fixed vulnerability
08-26-2010: vulnerability disclosed

11. REFERENCES

Original Advisory URL:
http://yehg.net/lab/pr0js/advisories/joomla/[com_bc]_cross_site_scripting
What XSS Can Do: http://yehg.net/lab/pr0js/view.php/What%20XSS%20Can%20Do.pdf
XSS FAQs: http://www.cgisecurity.com/articles/xss-faq.shtml
XSS (wiki): http://en.wikipedia.org/wiki/Cross-site_scripting
XSS (owasp): http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
OWASP Top 10: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
CWE-79: http://cwe.mitre.org/data/definitions/79.html

#yehg [08-26-2010]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/