full-disclosure - XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <510711E8.6050808@moritz-naumann.com>
Date: Tue, 29 Jan 2013 01:03:52 +0100
From: Moritz Naumann <security@...itz-naumann.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: XSS in Elgg 1.8.12,
	1.7.16 (core module "Twitter widget")

Hello dear XSS bored audience,

the PHP based social networking engine Elgg [1], versions 1.8.12 and
1.7.16 and earlier, bears a persistent script injection vulnerability in
its core module "Twitter widget", which allows for XSS attacks.

On installations which have the Twitter widget activated (disabled by
default, but in use on many installations), any authenticated user may
add the Twitter to their activity / dashboard page. Editing its
configuration allows the user to set the twitter_username parameter. The
value stored in this parameter will be echoed without sanitation [2]
when this page is viewed by any other user, authenticated or not.

For mitigation, the Twitter widget can be disabled by a site admin (in
the admin backend's plugin configuration area).

According to changes committed [3] to their Git repository Elgg
developers will provide a fix for this issue in the upcoming (?) 1.8.13
release.

This was originally reported by
     Moritz Naumann
     http://moritz-naumann.com
on January 17, to security[at]elgg.org, and got me a prompt vendor
reply. Coordination of advisory release is something to improve upon
next time.

A CVE ID has, to my knowledge, not yet been assigned. Secunia has
assigned it SA52007.

Have fun,

Moritz

[1] http://elgg.org/
[2]
http://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21
[3]
http://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/