[NT] Multiple DotNetNuke Cross Site Scripting (XSS)

From: SecuriTeam (support_at_securiteam.com)
Date: 05/17/05

  • Next message: SecuriTeam: "[UNIX] Woltlab Burning Board SQL Injection Vulnerability" 
    To: list@securiteam.com
Date: 17 May 2005 10:38:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Multiple DotNetNuke Cross Site Scripting (XSS)
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.dotnetnuke.com/> DotNetNuke is "an Open Source hybrid of the
    IBuySpy Portal. Its management team is dedicated to the ongoing management
    of core portal application enhancements. DotNetNuke provides automated
    content management capabilities and tools to maintain a dynamic and 100%
    interactive data-driven web site". Multiple cross site scripting
    vulnerabilities have been discovered in DotNetNuke.

    DETAILS

    Vulnerable Systems:
     * DotNetNuke version 3.0.11 and prior

    Immune Systems:
     * DotNetNuke version 3.0.12 or newer

    Issue 1 (XSS)
    There is a vulnerability caused by the lack of input validation when
    registering a new user within a DotNetNuke portal. An attacker could use a
    cross site scripting (XSS) attack when registering a new user, when the
    View All User Details page the malicious code will be executed, resulting
    in the capture of Administrative session credentials.

    Issue 2 (Secondary Attack Vector XSS)
    The User-Agent string sent with each request is stored for logging
    purposes. This data comes from the client and cannot be trusted, and
    therefore must be sanitized. An attacker could set the User-Agent string
    for the request to malicious script code, which would be logged and
    executed when any logs are viewed that contain the User-Agent field. This
    attack can be utilized by an unauthenticated user simply requesting the
    root page.

    Issue 3 (Secondary Attack Vector XSS)
    The failed logon username is stored and displayed on the Log Viewer page.
    An attacker can send a logon request with malicious script set as the
    parameter value, the script passed in the parameter will be executed when
    an Administrative user views the Log Viewer page or any log page that
    displays the failed logon username.

    Vendor Response:
    05-01-2005 Contacted core development team via email
    10-01-2005 Response from vendor received and confirmed
    10-01-2005 Second mail sent regarding more issues
    13-01-2005 Sent email asking for confirmation of second email (No vendor
    response)
    12-03-2005 DotNetNuke v3.0.12 released (All reported security issues
    fixed)

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0040>
    CAN-2005-0040

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:m.woan@eris.qinetiq.com>
    Mark Woan.
    The original article can be found at:
    <http://www.woany.co.uk/advisories/dotnetnukexss.txt>
    http://www.woany.co.uk/advisories/dotnetnukexss.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Woltlab Burning Board SQL Injection Vulnerability"

    Relevant Pages

    • [NEWS] ColdFusion Cross-Site Scripting Security Vulnerability (Default Error Page)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ColdFusionMX Web Sites that use the default ColdFusionMX Site-Wide Error ... be susceptible to a cross-site scripting attack using the HTTP ...
      (Securiteam)
    • [REVS] Understanding and Preventing DNS-related Attacks by Phishers
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... This paper, extending the original material of "The Phishing Guide", ... Internet-based customers are dependent upon, and how they can be exploited ... This paper focuses upon a recent group of attack vectors used by criminals ...
      (Securiteam)
    • [NT] Microsoft Outlook Web Access XSS (MS08-039)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Web Access (OWA) 2003/2007. ... Exchange Server 2007, Exchange Server 2007 SP1) ... An attacker can craft a malicious email which contains the attack strings ...
      (Securiteam)
    • [REVS] Multiple Collisions attack on MD5 and other Hashing Algorithms
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... This collision attack might someday introduce a weakness in MD5 ... The presented attack can find many real collisions which are ...
      (Securiteam)
    • [NT] Netegrity SiteMinder smpwservicescgi.exe Target Redirection
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Due to improper filtering of user provided data, a remote attacker can ... This allows an attacker to redirect the user to whatever site ...
      (Securiteam)