full-disclosure - [FD] zTree v3 Security Advisory - XSS Vulnerability - CVE-2015-7348

Open Source and information security mailing list archives

Message-ID: <CAMDUZo6DoXrCd-G5k5PSa0c8zPPNvFpADkG=RHps4g58CVDR8w@mail.gmail.com>
Date: Mon, 16 Nov 2015 22:13:53 +0200
From: Onur Yilmaz <onur@...sparker.com>
To: fulldisclosure@...lists.org, cert@...t.org, vuln@...unia.com, 
 bugs@...uritytracker.com, submissions@...ketstormsecurity.org, 
 bugtraq@...urityfocus.com
Subject: [FD] zTree v3 Security Advisory - XSS Vulnerability - CVE-2015-7348

Information
--------------------
Advisory by Netsparker.
Name: Multiple XSS Vulnerabilities in zTree v3
Affected Software : zTree
Affected Versions: v3.5.19.1 and possibly below
Vendor Homepage : https://github.com/zTree/zTree_v3
Vulnerability Type : Cross-site Scripting
Severity : Important
Status : Fixed
CVE-ID : CVE-2015-7348
Netsparker Advisory Reference : NS-15-019

Description
--------------------
By exploiting a Cross-site scripting vulnerability the attacker can hijack
a logged in user’s session. This means that the malicious hacker can change
the logged in user’s password and invalidate the session of the victim
while the hacker maintains access. As seen from the XSS example in this
article, if a web application is vulnerable to cross-site scripting and the
administrator’s session is hijacked, the malicious hacker exploiting the
vulnerability will have full admin privileges on that web application.

Technical Details
--------------------
Proof of Concept URLs for XSS in zTree 3.5.19.1:

/zTree_v3-master/demo/en/asyncData/getNodesForBigData.php?id='"--></style></scRipt><scRipt>alert(0x00FA30)</scRipt>

/zTree_v3-master/demo/en/asyncData/getNodes.php
(POST, id parameter)

For more information on cross-site scripting vulnerabilities read the
article Cross-site Scripting (XSS).

Advisory Timeline
--------------------
04/09/2015 - First Contact
16/11/2015 - Vendor Fixed
17/11/2015 - Advisory Released

Solution
--------------------
https://github.com/zTree/zTree_v3

Credits & Authors
--------------------
These issues have been discovered by Onur Yilmaz while testing Netsparker
Web Application Security Scanner (https://www.netsparker.com).

About Netsparker
--------------------
Netsparker finds and reports security flaws and vulnerabilities such as SQL
Injection and Cross-site Scripting (XSS) in all websites and web
applications regardless of the platform and the technology they are built
on. Netsparker's unique detection and exploitation techniques allow it to
be dead accurate in reporting vulnerabilities, hence it is the first and
only False Positive Free web application security scanner.

-- 
Onur Yılmaz - National General Manager

Netsparker Web Application Security Scanner <https://www.netsparker.com>
T: +90 (0)554 873 0482

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives