Advisory ID: HTB23156
Product: Xaraya=20
Vendor: Xaraya Development Group
Vulnerable Version(s): 2.4.0-b1 and probably prior
Tested Version: 2.4.0-b1
Vendor Notification: May 15, 2013=20
Public Disclosure: June 26, 2013=20
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2013-3639
Risk Level: Low=20
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Solution Status: Solution Available
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered four XSS vulnerabilities =
in Xaraya, which can be exploited to perform cross-site scripting attacks a=
gainst administrators of vulnerable application.
1) Multiple Cross-Site Scripting (XSS) in Xaraya: CVE-2013-3639
1.1 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data passed via the "id" HTTP GET parameter to "/index.php" script. A r=
emote attacker can trick a logged-in administrator to open a specially craf=
ted link and execute arbitrary HTML and script code in browser in context o=
f the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay administrator's cookies:
http://xaraya/index.php?func=3Dmodinfonew&id=3D%3Cscript%3Ealert%28document=
=2Ecookie%29;%3C/script%3E&module=3Dmodules&type=3Dadmin
1.2 The vulnerability exists due to insufficient filtration of user-supplie=
d data passed via the "interface" HTTP GET parameter to "/index.php" script=
=2E A remote attacker can trick a logged-in administrator to open a special=
ly crafted link and execute arbitrary HTML and script code in browser in co=
ntext of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay administrator's cookies:
http://xaraya/index.php?block_id=3D7&func=3Dmodify_instance&interface=3D%3C=
script%3Ealert%28document.cookie%29;%3C/script%3E&module=3Dblocks&tab=3Dcon=
fig&type=3Dadmin
1.3 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data passed via the "name" HTTP GET parameter to "/index.php" script. A=
remote attacker can trick a logged-in administrator to open a specially cr=
afted link and execute arbitrary HTML and script code in browser in context=
of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay administrator's cookies:
http://xaraya/index.php?func=3Daliases&module=3Dmodules&name=3D%3Cscript%3E=
alert%28document.cookie%29;%3C/script%3E&type=3Dadmin
1.4 The vulnerability exists due to insufficient filtration of user-supplie=
d data passed via the "tabmodule" HTTP GET parameter to "/index.php" script=
=2E A remote attacker can trick a logged-in administrator to open a special=
ly crafted link and execute arbitrary HTML and script code in browser in co=
ntext of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay administrator's cookies:
http://xaraya/index.php?func=3Dassignprivileges&module=3Dprivileges&tab=3Da=
uthsystem&tabmodule=3D%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&=
type=3Dadmin
---------------------------------------------------------------------------=
--------------------
Solution:
Vendor did not reply to numerous notifications. Currently we are not aware =
of any official solution for these vulnerabilities.
Unofficial patch developed by High-Tech Bridge Security Research Lab is ava=
ilable here: https://www.htbridge.com/advisory/HTB23156-patch.zip
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23156 - https://www.htbridge.com/advisory/=
HTB23156 - Multiple XSS Vulnerabilities in Xaraya.
[2] Xaraya - http://www.xaraya.com - Xaraya is a cutting edge open source =
framework (written in PHP) on which developers can create sophisticated web=
applications and designers enjoy considerable flexibility.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.