Joomla BC Cross Site Scripting

`=====================================================================  
Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability  
=====================================================================  
  
  
1. OVERVIEW  
  
The Joomla! Component com_bc was vulnerable to Cross Script Scripting  
(XSS) Vulnerability.  
  
  
2. PRODUCT DESCRIPTION  
  
The Joomla! Component com_bc is a widely-used Blastchat chat server  
component designed for website communities  
from the smallest personal websites to the huge megasites who desire  
to provide their members and visitors  
with a superb chat experience. BlastChat has currently been serving  
chat to over 50.000+ websites.  
  
  
3. VULNERABILITY DESCRIPTION  
  
The Joomla! Component com_bc does not properly escape parameters:-  
ctask, bcItemid, lang, nlang , rid, rsid, sec_code, template, and  
usergid.  
This leads to Cross Site Scripting vulnerability. For more information  
about this kind of vulnerability, see OWASP Top 10 - A2, WASC-8 and  
CWE-79: Improper Neutralization of Input During Web Page Generation  
('Cross-site Scripting').  
  
  
4. VERSIONS AFFECTED  
  
Versions Not Available (reason: Closed-source/Commercial Product)  
  
  
5. PROOF-OF-CONCEPT/EXPLOIT  
  
Vulnerable URL-1:  
index2.php?option=com_bc&no_html=1&task=load&ctask=enter&d=1&url=[victim_url]&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&&sec_code=[]&time_key=2010-08-11%2003:46:00&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=20&detaching=1  
  
Vulnerable URL-2:  
index2.php?option=com_bc&no_html=1&task=client&ctask=enter&d=0c39e7&url=[victim_url&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&sec_code=[]&time_key=2010-08-11%2018:45:20&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=7  
Affected parameters: d , no_html, ctask, bcItemid, lang, nlang , rid,  
rsid, sec_code, template, usergid  
  
http://yehg.net/lab/pr0js/advisories/joomla/com_bc_xss(rid).jpg  
  
  
6. IMPACT  
  
As this is a multi-user chat application "component", the impact of  
XSS is huge, ranking from cookie theft to mass client exploits.  
  
  
7. SOLUTION  
  
Reported vulnerabiltiy was fixed at 08-15-2010. It is now supposed to be safe.  
It is suggested that any web sites that use this component ask the  
vendor for the updated version.  
  
  
8. VENDOR  
  
Blastchat  
http://www.blastchat.com  
  
  
9. CREDIT  
  
This vulnerability was discovered by Aung Khant, http://yehg.net, YGN  
Ethical Hacker Group, Myanmar.  
  
  
10. DISCLOSURE TIME-LINE  
  
08-11-2010: discovered vulnerability  
08-11-2010: notified vendor  
08-15-2010: vendor fixed vulnerability  
08-26-2010: vulnerability disclosed  
  
  
11. REFERENCES  
  
Original Advisory URL:  
http://yehg.net/lab/pr0js/advisories/joomla/[com_bc]_cross_site_scripting  
What XSS Can Do: http://yehg.net/lab/pr0js/view.php/What%20XSS%20Can%20Do.pdf  
XSS FAQs: http://www.cgisecurity.com/articles/xss-faq.shtml  
XSS (wiki): http://en.wikipedia.org/wiki/Cross-site_scripting  
XSS (owasp): http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)  
OWASP Top 10: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project  
CWE-79: http://cwe.mitre.org/data/definitions/79.html  
  
#yehg [08-26-2010]  
  
---------------------------------  
Best regards,  
YGN Ethical Hacker Group  
Yangon, Myanmar  
http://yehg.net  
Our Lab | http://yehg.net/lab  
Our Directory | http://yehg.net/hwd  
  
`