ViewGit 0.0.6 - Multiple XSS Vulnerabilities

Impact:
-------
Users viewing the ViewGit web interface could be exposed to arbitrary
HTML source authored by an attacker, including malicious Flash or Java
objects, remotely sourced iFrame tags, malicious JavaScript, or other
content, that would be associated with the trust zone of the ViewGit web
interface. This could result in bypass of cross site request forgery
mitigation, account compromise, drive by download attacks or other
impacts. For more information about the potential impacts of client side
attacks see the BeEF Project at http://beefproject.com/.
 
Mitigating factors: 
-------------------
In order to inject arbitrary script, attackers must have the ability to
manipulate the git repository. Specifically, the attacker must be able
to create branches or tags.
 
Proof of Concept Exploit:
-------------------------
Javascript commands, the most simple being
<script>alert("XSS")</script>, can be used as the name for either a tag
or branch in any given repository and subsequently executed by pulling
them up in ViewGit's web interface. Tag names will be executed when
viewing the "Shortlog" table, and branch names will be executed when
viewing the "Shortlog" or "Heads" tables.
 
Steps to Reproduce:
-------------------
There are two different avenues of attack, so here are two different
ways to reproduce the attack:
 
Branch name exploit:
1. Create a git repository and initialize it with "git init".
2. Add this repository to ViewGit by editing its localconfig.php file
and adding it to the 'projects' array.
3. Now, add a file to the repository and commit it with the commands
"git add fileName" and "git commit"
4. Add a branch via the command "git branch '<script>alert("XSS")</script>'"
5. Navigate to viewgit/?a=summary&p=X where X is the name of the
repository you set up.
6. Observe the Javascript pop-up.
7. Note that this same pop-up will appear when navigating to
viewgit/?a=shortlog&p=X, where X is the name of the repository you set
up, for the same reason because both pages use the same "Shortlog"
table. Thus both problems are also fixed by the same patch.
 
Tag name exploit:
1. Create a git repository and initialize it with "git init".
2. Add this repository to ViewGit by editing its localconfig.php file
and adding it to the 'projects' array.
3. Now, add a file to the repository and commit it with the commands
"git add fileName" and "git commit"
4. Add a tag via the command "git tag -a '<script>alert("XSS")</script>'
-m "Message""
5. Navigate to viewgit/?a=summary&p=X where X is the name of the
repository you set up.
6. Observe the Javascript pop-up.
7. Note that this same pop-up will appear when navigating to
viewgit/?a=shortlog&p=X, where X is the name of the repository you set
up, for the same reason because both pages use the same "Shortlog"
table. Thus both problems are also fixed by the same patch.
 
Vendor Response:
----------------
Vendor has been alerted to this vulnerability and has applied the
suggested patches to ViewGit version 0.0.7

#  0day.today [2018-01-05]  #