OpenKM Stored Cross Site Scripting

`# Exploit Title: OpenKM Platform Remote Reflected Cross Site Scripting  
# Google Dork: N/A  
# Date: 18-11-2014  
# Exploit Author: Mohamed Abdelbaset Elnoby (@SymbianSyMoh)  
# Vendor Homepage: http://www.openkm.com/en  
<http://s.bl-1.com/h/mQ2bNXq?url=http://www.openkm.com/en>/  
# Software Link: http://www.openkm.com/en/download-english.html  
<http://s.bl-1.com/h/mQ2bTws?url=http://www.openkm.com/en/download-english.html>  
# Version: All versions < 6.4.19 (built 23338)  
# Tested on: All OS  
# CVE : 2014-9017  
  
-About OpenKM  
OpenKM is a Free/Libre document management system that provides a web  
interface for managing arbitrary files. OpenKM includes a content  
repository, Lucene indexing, and jBPM workflow. The OpenKM system was  
developed using Java technology.  
In 2005 two developers involved in open source technologies and expertise  
with some commercial document management solutions (Sharepoint, Documentum,  
Hummingbird, among others) like Excalibur search engine or Kofax OCR engine  
decided to start an open source project based on high level technologies to  
build a document management system that they decided to call OpenKM.  
"-Wikipedia"  
  
-Reference: http://en.wikipedia.org/wiki/OpenKM  
<http://s.bl-1.com/h/mQ2bYKv?url=http://en.wikipedia.org/wiki/OpenKM>  
  
-Vulnerability: Remote Reflected/Stored Cross Site Scripting with no remote  
interaction  
-Severity: Very Critical  
-Vulnerable Parameter(s)/Input(s): Tasks  
-Info: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29  
<http://s.bl-1.com/h/mQ2cfkx?url=https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29>  
-Impact: Remote Admin or Users Full Account Takeover with no interaction.  
  
-Attack Scenario:  
1. User#1 "Attacker" : Creates a task with a vulnerable name and assign it  
to another User/Admin "Targeted Victim".  
2. User#2 "Victim" : Got Exploited with the vulnerable Task made by the  
Attacker "User#1" since the Task notification will automatically appears to  
the assigned user side "Victim" also the notification popup displays the  
vulnerable task name and the victim will be exploited with no interactions.  
  
  
-PS: This is the most critical attack you will see on OpenKM platform  
because it will work remotely against users even with the same scenario  
described in the report you can steal/execute a JS in the Administrator's  
session.  
-PoC Video: http://youtu.be/3jBQFAAq23k  
  
Thanks  
  
  
--   
*Best Regards**,**,*  
  
  
*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist  
& Bug Bounty Hunter.  
LinkedIn  
<http://s.bl-1.com/h/mQ2ck6z?url=https://www.linkedin.com/in/symbiansymoh>Curriculum  
Vitae <http://s.bl-1.com/h/mQ2coW1?url=http://goo.gl/cNrVpL>  
<http://s.bl-1.com/h/mQ2ctv3?url=https://www.linkedin.com/in/symbiansymoh>  
Facebook  
<http://s.bl-1.com/h/mQ2cyJ5?url=https://fb.com/symbiansymoh>Twitter  
<http://s.bl-1.com/h/mQ2c3j7?url=https://twitter.com/symbiansymoh>  
`