Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability

2010-08-26T00:00:00
ID SECURITYVULNS:DOC:24574
Type securityvulns
Reporter Securityvulns
Modified 2010-08-26T00:00:00

Description

===================================================================== Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability =====================================================================

  1. OVERVIEW

The Joomla! Component com_bc was vulnerable to Cross Script Scripting (XSS) Vulnerability.

  1. PRODUCT DESCRIPTION

The Joomla! Component com_bc is a widely-used Blastchat chat server component designed for website communities from the smallest personal websites to the huge megasites who desire to provide their members and visitors with a superb chat experience. BlastChat has currently been serving chat to over 50.000+ websites.

  1. VULNERABILITY DESCRIPTION

The Joomla! Component com_bc does not properly escape parameters:- ctask, bcItemid, lang, nlang , rid, rsid, sec_code, template, and usergid. This leads to Cross Site Scripting vulnerability. For more information about this kind of vulnerability, see OWASP Top 10 - A2, WASC-8 and CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').

  1. VERSIONS AFFECTED

Versions Not Available (reason: Closed-source/Commercial Product)

  1. PROOF-OF-CONCEPT/EXPLOIT

Vulnerable URL-1: index2.php?option=com_bc&no_html=1&task=load&ctask=enter&d=1&url=[victim_url]&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&&sec_code=[]&time_key=2010-08-11%2003:46:00&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=20&detaching=1

Vulnerable URL-2: index2.php?option=com_bc&no_html=1&task=client&ctask=enter&d=0c39e7&url=[victim_url&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&sec_code=[]&time_key=2010-08-11%2018:45:20&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=7 Affected parameters: d , no_html, ctask, bcItemid, lang, nlang , rid, rsid, sec_code, template, usergid

http://yehg.net/lab/pr0js/advisories/joomla/com_bc_xss(rid).jpg

  1. IMPACT

As this is a multi-user chat application "component", the impact of XSS is huge, ranking from cookie theft to mass client exploits.

  1. SOLUTION

Reported vulnerabiltiy was fixed at 08-15-2010. It is now supposed to be safe. It is suggested that any web sites that use this component ask the vendor for the updated version.

  1. VENDOR

Blastchat http://www.blastchat.com

  1. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN Ethical Hacker Group, Myanmar.

  1. DISCLOSURE TIME-LINE

08-11-2010: discovered vulnerability 08-11-2010: notified vendor 08-15-2010: vendor fixed vulnerability 08-26-2010: vulnerability disclosed

  1. REFERENCES

Original Advisory URL: http://yehg.net/lab/pr0js/advisories/joomla/[com_bc]cross_site_scripting What XSS Can Do: http://yehg.net/lab/pr0js/view.php/What%20XSS%20Can%20Do.pdf XSS FAQs: http://www.cgisecurity.com/articles/xss-faq.shtml XSS (wiki): http://en.wikipedia.org/wiki/Cross-site_scripting XSS (owasp): http://www.owasp.org/index.php/Cross-site_Scripting(XSS) OWASP Top 10: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project CWE-79: http://cwe.mitre.org/data/definitions/79.html

yehg [08-26-2010]


Best regards, YGN Ethical Hacker Group Yangon, Myanmar http://yehg.net Our Lab | http://yehg.net/lab Our Directory | http://yehg.net/hwd