Vulners
Lucene search
osTicket 1.9.12 Cross Site Scripting
`------------------------------------------------------------------------
Multiple persistent Cross-Site Scripting vulnerabilities in osTicket
------------------------------------------------------------------------
Han Sahin, July 2016
------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
Two persistent Cross-Site Scripting vulnerabilities have been found in
osTicket. These issues exists due to the lack of output encoding on user
input. These vulnerabilities allow an attacker to inject malicious
JavaScript code into the application. This code will then be executed
within the browser of a user who views the dashboard. The
attacker-supplied code can perform a wide variety of actions, such as
stealing victims' session tokens or login credentials, performing
arbitrary actions on their behalf.
------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
These issues were successfully tested on osTicket version 1.9.12.
------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
osTicket version 1.9.15 and osTicket version 1.10 are released that
address these vulnerabilities.
------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20160801/multiple_persistent_cross_site_scripting_vulnerabilities_in_osticket.html
The first issue is located in the file include/staff/header.inc.php and exists due to the fact that the Helpdesk name/title lacks encoding.
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
<meta http-equiv="cache-control" content="no-cache" />
<meta http-equiv="pragma" content="no-cache" />
<meta http-equiv="x-pjax-version" content="<?php echo GIT_VERSION; ?>">
<title><?php echo ($ost && ($title=$ost->getPageTitle()))?$title:'osTicket :: '.__('Staff Control Panel'); ?></title>
The second vulnerability exists because of the lack of output encoding on the X-Forwarded-For HTTP header. When sending a request with a malicious value in the X-Forwarded-For HTTP header to osTicket, this value will be displayed in the system log dashboard. If script code is added to the X-Forwarded-For HTTP header such code will be injected into the dashboard.
include/staff/ticket-view.inc.php:
<tr>
<th><?php echo __('Source'); ?>:</th>
<td><?php
echo Format::htmlchars($ticket->getSource());
if (!strcasecmp($ticket->getSource(), 'Web') && $ticket->getIP())
echo ' <span class="faded">('.$ticket->getIP().')</span>';
?>
</td>
</tr>
include/staff/syslogs.inc.php:
<tr id="<?php echo $row['log_id']; ?>">
<td align="center" nowrap>
<input type="checkbox" class="ckb" name="ids[]" value="<?php echo $row['log_id']; ?>"
<?php echo $sel?'checked="checked"':''; ?>> </td>
<td> <a class="tip" href="#log/<?php echo $row['log_id']; ?>"><?php echo Format::htmlchars($row['title']); ?></a></td>
<td><?php echo $row['log_type']; ?></td>
<td> <?php echo Format::daydatetime($row['created']); ?></td>
<td><?php echo $row['ip_address']; ?></td>
</tr>
These vulnerabilities allow an attacker to inject malicious JavaScript code into the application. This code will then be executed within the browser of a user who views the dashboard. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Mar 2017 00:00Current