jPlayer 2.2.22 XSS / Content Spoofing

`Hello list!  
  
I want to inform you about multiple vulnerabilities in jPlayer. These are   
Cross-Site Scripting and Content Spoofing and vulnerabilities in jPlayer.   
Which is used at tens thousands of web sites and in multiple web   
applications.  
  
-------------------------  
Affected products:  
-------------------------  
  
Vulnerable are versions before jPlayer 2.2.23. Version 2.2.23 and the last   
released version 2.3.0 are not vulnerable to mentioned XSS, except CS via JS   
and XSS via JS callbacks. Also there are other bypass methods which work in   
version 2.3.0, but the developers haven't fixed them besides attack via   
alert. About that I've wrote to developers already in March and reminded   
again. So wait for new version with fixing of these vulnerabilities.  
  
-------------------------  
Affected vendors:  
-------------------------  
  
Happyworm  
http://www.jplayer.org  
  
----------  
Details:  
----------  
  
Cross-Site Scripting (WASC-08):  
  
In different versions of jPlayer there are different XSS vulnerabilities.  
  
0.2.1 - 1.2.0:  
  
http:/site/Jplayer.swf?id=%22))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//  
  
2.0.0:  
  
http:/site/Jplayer.swf?id=%27))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//  
  
2.1.0:  
  
http:/site/Jplayer.swf?jQuery=)}catch(e){}if(!self.a)self.a=!alert(document.cookie)//  
  
http:/site/Jplayer.swf?id=%27))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//  
  
In version 2.2.0 these XSS vulnerabilities were fixed (the developers was   
informed about hole in jQuery parameter and made a fix, which protected from   
both attacks). But Malte Batram (in version 2.2.19) and I (in version   
2.2.20) have found new ones.  
  
2.2.0 - 2.2.19 (and previous versions):  
  
Attack works in Firefox (all versions and browsers on Gecko engine), IE6 and   
Opera 10.62.  
  
http:/site/Jplayer.swf?jQuery=document.write&id=%3Cimg%20src=1%20onerror=alertu0028document.cookieu0029%3E  
  
2.2.20 - 2.2.22 (and previous versions):  
  
http:/site/Jplayer.swf?jQuery=alert&id=XSS  
  
Content Spoofing (WASC-12):  
  
It's possible to conduct CS (inclusion of audio/video files from external   
resources) via JS and XSS via JS callbacks. This requires HTML Injection   
vulnerability at the site. The attack is similar to XSS attacks via   
callbacks in JW Player (http://securityvulns.ru/docs28176.html).  
  
Because this attack vector requires separate vulnerability at target site to   
conduct CS and XSS attacks with using of jPlayer, the developers didn't do   
anything to fix it. The same as developers JW Player. So protection from   
this attack scenario lies solely on web sites owners.  
  
------------  
Timeline:  
------------   
  
2013.01.31 - found vulnerabilities in jPlayer at multiple web sites (in   
version 2.1.0).  
2013.03.14 - announced at my site.  
2013.03.19 - informed developers.  
2013.03.19-30 - discussed with developers different vulnerabilities in   
different versions of jPlayer and at their sites.  
2013.03.21 - developers was informed by Malte Batram's about XSS hole in   
2.2.19.  
2013.03.21 - developers fixed Malte's XSS hole in 2.2.20 in github   
(CVE-2013-1942).  
2013.03.22 - informed developers about new hole, which works in 2.2.20.  
2013.03.23 - sent details of new XSS and warned about possibility for other   
XSS attacks and gave recommendations about proper fixing of XSS to prevent   
any future XSS.  
2013.03.30 - reminded developers about last hole.  
2013.04.12 - developers fixed my XSS hole in 2.2.23 in github.  
2013.04.20 - developers released jPlayer 2.3.0   
(http://www.jplayer.org/2.3.0/release-notes/) and informed me.  
2013.04.20 - disclosed at my site about jPlayer   
(http://websecurity.com.ua/6379/).  
2013.04.21 - tested version 2.3.0 and found that developers fixed only one   
attack vector and didn't make complete fix, as I recommended in March, so I   
reminded them and sent them examples of two new XSS.  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`