full-disclosure - xss in trixbox ce (asterisk phonebook) via the contact page and import contacts (csv file).

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 14 Oct 2010 11:50:47 +1100
From: dave b <db.pub.mail@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: xss in trixbox ce (asterisk phonebook) via the
 contact page and import contacts (csv file).

The asterisk phonebook module found in trixbox CE is vulnerable to an
xss which can be triggered by importing a contact from a csv file like
this:

"/><script>alert(document.cookie);</script>";123123123;12313 FATAL ERROR

url is $ip/admin/config.php?type=tool&display=phonebook
So an import of a csv file which may contain untrusted data is now
dangerous. (the above csv file example will result in your cookie
being displayed when imported ^^).

This really a bug in the asterisk phonebook module installing the
module into asterisknow or freepbx will also mean that the xss can be
used.
However, it appears that trixbox ce is the only distribution to have
the module installed out of the box.

This post is for JshWright.

--
There's small choice in rotten apples.		-- William Shakespeare, "The
Taming of the Shrew"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/