Vulners
Lucene search
Microsoft Report Viewer Cross Site Scripting
| Reporter | Title | Published | Views | Family All 12 |
|---|---|---|---|---|
 | CVE-2011-1976 | 9 Aug 201100:00 | – | circl |
 | Microsoft Report Viewer TimeMethod Information Disclosure (MS11-067; CVE-2011-1976) | 9 Aug 201100:00 | – | checkpoint_advisories |
 | CVE-2011-1976 | 10 Aug 201121:16 | – | cve |
 | CVE-2011-1976 | 10 Aug 201121:16 | – | cvelist |
 | MS11-067: Vulnerability in Microsoft Report Viewer could allow information disclosure: August 9, 2011 | 9 Aug 201100:00 | – | mskb |
 | CVE-2011-1976 | 10 Aug 201121:55 | – | nvd |
 | Microsoft Report Viewer Information Disclosure Vulnerability (2578230) | 11 Aug 201100:00 | – | openvas |
| Microsoft Report Viewer Information Disclosure Vulnerability (2578230) | 11 Aug 201100:00 | – | openvas |
 | Cross site scripting | 10 Aug 201121:55 | – | prion |
 | Cross-Site Scripting (XSS) in Microsoft ReportViewer Controls | 30 Aug 201100:00 | – | securityvulns |
10
`==================================================
Cross-Site Scripting (XSS) in Microsoft ReportViewer Controls
Adam Bixby - Gotham Digital Science ([email protected])
Public Release Date: 8/9/2011
Confirmed Affected Software: Microsoft Report Viewer Redistributable 2005 SP1 and Microsoft Visual Studio 2005 Service Pack 1
Browser used for testing: IE8 (8.0.7601.17514)
Severity: High
MS Bulletin: MS11-067 - http://www.microsoft.com/technet/security/Bulletin/MS11-067.mspx
CVE: CVE-2011-1976
==================================================
1. Summary
==================================================
The Microsoft ReportViewer Controls are a freely redistributable control that enables embedding reports in applications developed using the .NET Framework. A Cross-Site Scripting (XSS) vulnerability was found in the Microsoft.ReportViewer.WebForms.dll. The XSS vulnerability appears to affect all websites that utilize the affected controls.
==================================================
2. Technical Details
==================================================
File: Microsoft.ReportViewer.WebForms.dll (PerformOperation() method of the SessionKeepAliveOperation class)
1) User controllable data enters via the "TimerMethod" URL parameter value and is assigned to the "andEnsureParam" string variable.
string andEnsureParam = HandlerOperation.GetAndEnsureParam(urlQuery, "TimerMethod");
2) The "andEnsureParam" variable with user-controllable input is then passed into the "s" string variable which is dynamically building a javascript block. The "s" variable is then passed to response.write(). Writing the un-validated data to the JS block creates the XSS exposure.
string s = string.Format(CultureInfo.InvariantCulture, "<html><body><script type=\"text/javascript\">parent.{0}();</script></body></html>", new object[] { andEnsureParam });
response.Write(s);
==================================================
3. Proof-of-Concept Exploit
==================================================
This vulnerability can be exploited against websites that have deployed the vulnerable Microsoft.ReportViewer.WebForms.dll. You will note that since the data is being written into an existing Javascript block that the attacker does not need to include any opening or closing tags (i.e.,<img>, <script>, etc) to execute code.
Reproduction Request:
https://test.com/Reserved.ReportViewerWebControl.axd?Mode=true&ReportID=<arbitraryIDvalue>&ControlID=<validControlID>&Culture=1033&UICulture=1033&ReportStack=1&OpType=SessionKeepAlive&TimerMethod=KeepAliveMethodctl00_PlaceHolderMain_SiteTopUsersByHits_ctl00TouchSession0;alert(document.cookie);//&CacheSeed=
(Note: During testing of this issue, it appeard as though a valid ControlID parameter value was needed to exploit this issue)
==================================================
4. Recommendation
==================================================
Update to the latest versions. For more information please see http://www.microsoft.com/technet/security/Bulletin/MS11-067.mspx
==================================================
5. About Gotham Digital Science
==================================================
Gotham Digital Science (GDS) is an information security consulting firm that works with clients to identify, prevent, and manage security risks. For more information on GDS, please contact [email protected] or visit http://www.gdssecurity.com.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
25 Aug 2011 00:00Current
6.5Medium risk
Vulners AI Score6.5
EPSS0.65671