Vulnerabilities 2010

PR09-20 XSS on CommonSpot server

• Advisory publicly released: Thursday, 4 February 2010
• Vulnerability found: Thursday, 17 December 2009
• Vendor informed: Friday, 18 December 2009
• Severity level: Medium

• Credits
  Found by Richard Brain & Jan Fry - ProCheckUp Ltd
• Description
  Commonspot server is vulnerable to a vanilla XSS
  
  Vulnerable server-side script: 'commonspot/utilities/longproc.cfm'
  
  Unfiltered parameter: 'url'
  
  Successfully tested on: Commonspot server v4.6.3.47
  http://www.paperthin.com/
  
  Consequences:
  
  An attacker may be able to cause execution of malicious scripting code in the browser of a victim user who clicks on a link to a RSA Authentication Agent login page. Such code would run within the context of the target domain.
  
  This type of attack can result in non-persistent defacement of the target site, or the redirection of confidential information (i.e.: session IDs or passwords) to unauthorised third parties.
• Proof of concept
  https://target-domain.foo/commonspot/utilities/longproc.cfm?onlyurlvars=1&url=%27;--%3E%3C/script%3E%3Cscript%3Ealert%281%29%3C/script%3E
• How to fix
  
• References
  

  BID 37986
  http://www.securityfocus.com/bid/37986

  
  
• Legal
  Copyright 2009 Procheckup Ltd. All rights reserved.
  
  Permission is granted for copying and circulating this Bulletin to the Internet community
  for the purpose of alerting them to problems, if and only if, the Bulletin is not edited
  or changed in any way, is attributed to Procheckup, and provided such reproduction and/or
  distribution is performed for non-commercial purposes.
  
  
  Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.