Two Vulnerabilities in ViewCVS

From: Joxean Koret (joxeankoret_at_yahoo.es)
Date: 01/01/05

  • Next message: Byron Copeland: "[Full-Disclosure] Win32 based" 
    To: Security Tracker <bugs@securitytracker.com>, Secunia <vuln@secunia.com>, Full Disclosure <full-disclosure@lists.netsys.com>, bugtraq@securityfocus.com
Date: Sat, 01 Jan 2005 20:03:05 +0000

    ---------------------------------------------------------------------------
                  Two Vulnerabilities in ViewCVS
    ---------------------------------------------------------------------------

    Author: Jose Antonio Coret (Joxean Koret)
    Date: 2004
    Location: Basque Country

    ---------------------------------------------------------------------------

    Affected software description:
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ViewCVS 0.9.2 - ViewCVS is a browser interface for CVS and Subversion
    version control repositories

    ViewCVS can browse directories, change logs, and revisions of files. It
    can display diffs between versions and show selections of files based on
    tags or branches. In addition, ViewCVS has "annotation" / "blame"
    support, and Bonsai-like query facility

    Web : http://viewcvs.sourceforge.net

    ---------------------------------------------------------------------------

    Vulnerabilities:
    ~~~~~~~~~~~~~~~~

    A. Cross Site Scripting Vulnerability and/or HTTP Response Splitting

    A1. When you want to view any source file that is stored in the CVS
    repository you can
    select the mime-type to view this (in example, text/html or text/plain).
    This is a
    parameter that receives thet viewcvs.py script and is not verified.

    I'm not sure if this is an HTTP Response Splitting vulnerability and/or
    a Cross Site Scripting,
    but is a security problem.

    To try the vulnerabilities you can try the following the Proof of
    Concepts:

            Sample 1 :
            ~~~~~~~~~~

    http://>/cgi-bin/viewcvs/project/source.file?rev=HEAD&content-type=text/html%0d%0a%0d%0a<html><body%20bgcolor="black"><font%20size=7%20color=red>XSS%20or%20HTTP%20Response%20Splitting</font></html>

            Sample 2 :
            ~~~~~~~~~~

    http://>/cgi-bin/viewcvs/*checkout*/project/source.file?rev=1.0&content-type=text/html%0d%0aContent-Length:1937%0d%0a%0d%0aHi

    The fix:
    ~~~~~~~~

    The vendor was contacted but no path for the 0.9.2 version has been
    released. Anyway, the
    problems has been fixed in the ViewCVS 1.0-dev version available via
    CVS.

    Disclaimer:
    ~~~~~~~~~~~

    The information in this advisory and any of its demonstrations is
    provided
    "as is" without any warranty of any kind.

    I am not liable for any direct or indirect damages caused as a result of
    using the information or demonstrations provided in any part of this
    advisory.

    ---------------------------------------------------------------------------

    Contact:
    ~~~~~~~~

            Joxean Koret at joxeanpiti<<<<<<<<@>>>>>>>>yah00<<<<<<dot>>>>>es

  • Next message: Byron Copeland: "[Full-Disclosure] Win32 based"

    Relevant Pages

    • Two Vulnerabilities in ViewCVS
      ... ViewCVS 0.9.2 - ViewCVS is a browser interface for CVS and Subversion ... Cross Site Scripting Vulnerability and/or HTTP Response Splitting ... To try the vulnerabilities you can try the following the Proof of ...
      (Bugtraq)
    • [Full-Disclosure] Two Vulnerabilities in ViewCVS
      ... ViewCVS 0.9.2 - ViewCVS is a browser interface for CVS and Subversion ... Cross Site Scripting Vulnerability and/or HTTP Response Splitting ... To try the vulnerabilities you can try the following the Proof of ...
      (Full-Disclosure)
    • [UNIX] HTTP Response Splitting and Cross Site Scripting in ViewCVS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ViewCVS is "a browser interface for CVS ... HTTP Response Splitting and Cross Site Scripting in content-type ...
      (Securiteam)
    • [Full-disclosure] ViewCVS 0.9.4 issues
      ... Security issue on ViewCVS 0.9.4 ... Not really exploitable unless malicious users have CVS write access ... AND victim visits pre-crafted URL ... This was previously considered a HTTP response splitting vulnerability ...
      (Full-Disclosure)
    • ViewCVS 0.9.4 issues
      ... Security issue on ViewCVS 0.9.4 ... Not really exploitable unless malicious users have CVS write access ... AND victim visits pre-crafted URL ... This was previously considered a HTTP response splitting vulnerability ...
      (Bugtraq)