____ ____ __ __ / \ / \ | | | | ----====####/ /\__\##/ /\ \##| |##| |####====---- | | | |__| | | | | | | | ___ | __ | | | | |
------======######\ \/ /#| |##| |#| |##| |######======------ \_/ |_| || \______/
Computer Academic Underground http://www.caughq.org Security Advisory
===============/======================================================== Advisory ID: CAU-2008-0002 Release Date: 04/08/2008 Title: Microsoft Windows SharePoint Services Picture Source XSS Application/OS: Microsoft Windows SharePoint Services 2.0 Topic: A stored Cross Site Scripting (XSS) attack is possible in Microsoft SharePoint Services 2.0 via picture object source when adding a picture object to a page. Vendor Status: Not Notified Attributes: XSS, Web Service, Microsoft Tuesday Advisory URL: http://www.caughq.org/advisories/CAU-2008-0002.txt Author/Email: OneIdBeagl3 <oneidbeagl3 (at) caughq.org> ===============/========================================================
Microsoft Windows Share Point Services 2.0
The string below is not properly sanitized when the web page is saved after adding a picture using the application's text editor:
Unless editing web pages in SharePoint 2.0 is necessary, disable this feature. If the feature is necessary, ensure users must authenticate to a service before giving them the privilege to create or edit pages, and only afford users the privileges if they need to create or edit pages. This practice will help leave an audit trail to determine which account was used to create a malicious web page if an incident takes place.
1) Log-in as a user that has enough privileges to create a web page.
2) In the web page on the top toolbar click on Create.
3) Under the 'Web Pages' section, click on 'Basic Page.'
4) Pick a web page name and click the create button.
5) In IE 7, an Edit Content Link appears in the upper right hand corner. Click on it and it should open up a "Rich Text Editor -- Webpage Dialog" window.
6) Add a picture to the page, and in the 'Picture Source' enter the following:
CAU & HDM
-- I)ruid, C²ISSP email@example.com http://druid.caughq.org