full-disclosure - XSS in Squirrelmail plugin 'Virtual Keyboard' <= 0.9.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4CAB522C.7060409@moritz-naumann.com>
Date: Tue, 05 Oct 2010 18:28:28 +0200
From: Moritz Naumann <security@...itz-naumann.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: XSS in Squirrelmail plugin 'Virtual Keyboard' <=
	0.9.1

Hi,

Squirrelmail plugin 'Virtual Keyboard' version 0.9.1 and lower is
vulnerable to cross site scripting (XSS).

The vkeyboard.php script fails to sanitize the value of HTTP GET
parameter 'passformname' which the script stores in a variable of the
same name and outputs (unmodified) into a HTML document later. As such,
it is possible to inject client-evaluated HTML and script code into the
output generated by the application.

For proof of concept, accessing the following location ([Base_URL]
refers to a Squirrelmail installation with a vulnerable version of the
'Virtual Keyboard' plugin) results in a javascript generated alert
windows reading 'XSS' popping up:
> [Base_URL]/plugins/vkeyboard/vkeyboard.php?passformname=%22%3E%3Cscript%3Ealert%28%27XSS%27%29;%3C/script%3E%3Cscript%3E/*%20

'Virtual Keyboard' installations can be found using this 'Google dork':
> http://google.com/search?hl=en&safe=off&filter=0&q=inurl%3A%22vkeyboard.php%22

This vulnerability was originally reported in early May 2010.
A suitable update fixing this issue, Virtual Keyboard v0.9.2 for
Squrrelmail 1.4.x, has been provided to the Squirrelmail developers and
me by Daniel Kobayashi Imori of Bastion Systems (the original developer
of this plugin) in early June 2010 and is attached to this email -
thanks Daniel. The Squirrelmail team has not yet made it to update this
plugin in their repository:
  http://squirrelmail.org/plugin_view.php?id=159

So this is the first public release I am aware of.

Thanks for reading,

Moritz Naumann
-- 
Naumann IT Security Consulting
Samariterstr. 16
10247 Berlin
Germany

Download attachment "vkeyboard-0.9.2-1.4.0.tar.gz" of type "application/x-gzip" (24601 bytes)

Download attachment "vkeyboard-0.9.2-1.4.0.tar.gz.gpg" of type "application/octet-stream" (25206 bytes)

View attachment "vkeyboard-0.9.2-1.4.0.tar.gz.sha512" of type "text/plain" (159 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/