MoinMoin 1.9.8 Cross Site Scripting

`Security Advisory - Curesec Research Team  
  
1. Introduction  
  
Affected Product: MoinMoin 1.9.8  
Fixed in: 1.9.9  
Fixed Version Link: http://static.moinmo.in/files/moin-1.9.9.tar.gz  
Vendor Website: https://moinmo.in  
Vulnerability Type: XSS  
Remote Exploitable: Yes  
Reported to vendor: 09/05/2016  
Disclosed to public: 11/10/2016  
Release mode: Coordinated Release  
CVE: CVE-2016-7148, CVE-2016-7146  
Credits Tim Coen of Curesec GmbH  
  
2. Overview  
  
MoinMoin is an open source Wiki application written in python. In version  
1.9.8, it is vulnerable to two persistent XSS issues. This allows an attacker  
to steal cookies, inject JavaScript keyloggers, or bypass CSRF protection.  
  
3. Details  
  
XSS 1: Persistent XSS (CVE-2016-7148)  
  
CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N  
  
Description: A page name is echoed in the attach file page without encoding,  
leading to persistent XSS.  
  
Proof of Concept:  
  
To place the payload create a new page which contains the payload as name by  
visiting: http://localhost:9090/  
newtest%27%22%3E%3Cimg%20src%3Dno%20onerror%3Dalert%287%29%3E?action=edit To  
trigger the payload visit the attach file page: http://localhost:9090/  
newtest%27%22%3E%3Cimg%20src%3Dno%20onerror%3Dalert%287%29%3E?action=AttachFile  
Note that there must be at least one existing attachment.  
  
XSS 2: Persistent XSS (CVE-2016-7146)  
  
CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N  
  
Description: The GUI editor is vulnerable to XSS via a specifically crafted  
URL, as it echoes part of the URL without encoding in two different places. The  
issue can be exploited reflected or persistent.  
  
Proof of Concept:  
  
Reflected example (the page does not have to exist): http://localhost:9090/'">  
<img src=no onerror=alert(1)>?action=fckdialog&dialog=attachment Alternatively,  
an attacker can create a page containing the payload: http://localhost:9090/  
newtestfoo'%22%3E%3Cimg%20src=no%20onerror=alert(1)%3E The payload is triggered  
when attaching a file via the the GUI editor ("Edit (GUI)" -> "Attachment").  
  
4. Solution  
  
To mitigate this issue please upgrade at least to version 1.9.9:  
  
http://static.moinmo.in/files/moin-1.9.9.tar.gz  
  
Please note that a newer version might already be available.  
  
5. Report Timeline  
  
09/05/2016 Contacted Vendor, Vendor confirmed, Requested CVEs  
09/06/2016 CVEs assigned and distributed to vendor  
10/05/2016 Vendor requests more time  
10/31/2016 Vendor releases fix  
11/10/2016 Disclosed to public  
  
  
Blog Reference:  
https://www.curesec.com/blog/article/blog/MoinMoin-198-XSS-175.html  
  
--  
blog: https://www.curesec.com/blog  
tweet: https://twitter.com/curesec  
  
Curesec GmbH  
Curesec Research Team  
Josef-Orlopp-StraAe 54  
10365 Berlin, Germany  
  
  
`