kayakoXSS.txt

`  
--BQPnanjtCNWHyqYD  
Content-Type: text/plain; charset=us-ascii  
Content-Disposition: inline  
Content-Transfer-Encoding: quoted-printable  
  
http://www.google.com/search?q=3D%22Powered+By+kayako+eSupport%22+%22search=  
+the+entire+knowledgebase%22  
  
1290 customers according to Google.  
  
http://support.kayako.com/index.php?_a=3Dknowledgebase&_j=3Dquestiondetails=  
&_i=3D2&nav=3D[XSS]&nav2=3DGeneral%20eSupport%20Q&A  
  
Vendor notified by their access log files (and this email to their sales st=  
aff):  
  
http://support.kayako.com/index.php?_a=3Dknowledgebase&_j=3Dquestiondetails=  
&_i=3D2&nav=3D%3Cscript%3Ealert('msg')%3C/script%3E  
  
Keeping this short and sweet since XSS vulns aren't that big of a deal=20  
to find, even still. Clients login with cookies with a "remember me"=20  
check box. I thought it was at least significant because of what "nav"=20  
is for. The "nav" value is inserted as a subheading of the main page=20  
node, and one website I saw this at inserted html code with a link in=20  
the nav argument. Nice. One of those "double take" moments. This XSS=20  
was used as a "feature", leveraged by a customer: a hosting company. I=20  
was in awe. They should simply know better. So should Kayako.  
  
Now, let's see how fast Kayako can release a security bulletin to their=20  
customers. Isn't a security audit a part of every release?  
  
No fix yet, since the code is proprietary. I always release fixes for=20  
free software / open source code. I can't do that with proprietary=20  
code, though.  
  
Cheers,  
  
Seth  
  
P.S. Vendors have burned me and their users in the past for not fessing=20  
up or giving credit where due; I agree with Linus Torvalds, vendor-sec=20  
and ideas like it are a bad idea:  
  
"I happen to believe in openness, and vendor-sec does not. It's that=20  
simple." ( http://www.internetnews.com/dev-news/article.php/3458961 )  
  
--=20  
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized  
Key id EF10E21A =3D 36AD 8A92 8499 8439 E6A8 3724 D437 AF5D EF10 E21A  
  
--BQPnanjtCNWHyqYD  
Content-Type: application/pgp-signature  
Content-Disposition: inline  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.0 (GNU/Linux)  
  
iD8DBQFCEa+gej9tPAC6OvMRAnxtAJ0XhPcQD+DA/kSqdToUYwqg6PNVewCg+iNN  
EUe8h2jaJTurC/rYDDwXVoI=  
=Mi2p  
-----END PGP SIGNATURE-----  
  
--BQPnanjtCNWHyqYD--  
`