viewcvs.txt

2005-01-02T00:00:00
ID PACKETSTORM:35582
Type packetstorm
Reporter Joxean Koret
Modified 2005-01-02T00:00:00

Description

                                        
                                            `---------------------------------------------------------------------------  
Two Vulnerabilities in ViewCVS  
---------------------------------------------------------------------------  
  
Author: Jose Antonio Coret (Joxean Koret)  
Date: 2004   
Location: Basque Country  
  
---------------------------------------------------------------------------  
  
Affected software description:  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
ViewCVS 0.9.2 - ViewCVS is a browser interface for CVS and Subversion  
version control repositories  
  
ViewCVS can browse directories, change logs, and revisions of files. It  
can display diffs between versions and show selections of files based on  
tags or branches. In addition, ViewCVS has "annotation" / "blame"  
support, and Bonsai-like query facility  
  
Web : http://viewcvs.sourceforge.net  
  
---------------------------------------------------------------------------  
  
Vulnerabilities:  
~~~~~~~~~~~~~~~~  
  
A. Cross Site Scripting Vulnerability and/or HTTP Response Splitting  
  
A1. When you want to view any source file that is stored in the CVS  
repository you can   
select the mime-type to view this (in example, text/html or text/plain).  
This is a   
parameter that receives thet viewcvs.py script and is not verified.  
  
I'm not sure if this is an HTTP Response Splitting vulnerability and/or  
a Cross Site Scripting,  
but is a security problem.  
  
To try the vulnerabilities you can try the following the Proof of  
Concepts:   
  
Sample 1 :  
~~~~~~~~~~  
  
  
http://<site-with-viewcvs-092>/cgi-bin/viewcvs/project/source.file?rev=HEAD&content-type=text/html%0d%0a%0d%0a<html><body%20bgcolor="black"><font%20size=7%20color=red>XSS%20or%20HTTP%20Response%20Splitting</font></html>  
  
Sample 2 :  
~~~~~~~~~~  
  
  
http://<site-with-viewcvs-092>/cgi-bin/viewcvs/*checkout*/project/source.file?rev=1.0&content-type=text/html%0d%0aContent-Length:1937%0d%0a%0d%0aHi  
  
  
The fix:  
~~~~~~~~  
  
The vendor was contacted but no path for the 0.9.2 version has been  
released. Anyway, the   
problems has been fixed in the ViewCVS 1.0-dev version available via  
CVS.  
  
Disclaimer:  
~~~~~~~~~~~  
  
The information in this advisory and any of its demonstrations is  
provided  
"as is" without any warranty of any kind.  
  
I am not liable for any direct or indirect damages caused as a result of  
using the information or demonstrations provided in any part of this  
advisory.   
  
---------------------------------------------------------------------------  
  
Contact:  
~~~~~~~~  
  
Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es  
  
  
  
`