Advisory ID: HTB23179
Product: Claroline
Vendor: Claroline Consortium
Vulnerable Version(s): 1.11.8 and probably prior
Tested Version: 1.11.8
Advisory Publication: October 23, 2013 [without technical details]
Vendor Notification: October 23, 2013=20
Vendor Patch: November 7, 2013=20
Public Disclosure: November 27, 2013=20
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2013-6267
Risk Level: Medium=20
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://w=
ww.htbridge.com/advisory/ )=20
---------------------------------------------------------------------------=
--------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities =
in Claroline, which can be exploited to perform Cross-Site Scripting (XSS) =
attacks against vulnerable web application visitors and administrators.
1) Cross-Site Scripting (XSS) in Claroline: CVE-2013-6267
1.1 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data in "box" HTTP GET parameter passed to "/claroline/messaging/messag=
ebox.php" script. A remote attacker can trick a logged-in user to open a sp=
ecially crafted link and execute arbitrary HTML and script code in browser =
in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay "immuniweb" word:
http://[host]/claroline/messaging/messagebox.php?box=3D%22%3E%3Cscript%3Eal=
ert%28%27imuniweb%27%29;%3C/script%3E
1.2 The vulnerability exists due to insufficient filtration of user-supplie=
d data in "cidToEdit" HTTP GET parameter passed to "/claroline/admin/adminr=
egisteruser.php" script. A remote attacker can trick a logged-in administra=
tor to open a specially crafted link and execute arbitrary HTML and script =
code in browser in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay "immuniweb" word:
http://[host]/claroline/admin/adminregisteruser.php?cidToEdit=3D94102_001%2=
2%3E%3Cscript%3Ealert%28%27imuniweb%27%29;%3C/script%3E
1.3 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data in "cidToEdit" HTTP GET parameter passed to "/claroline/admin/admi=
n_user_course_settings.php" script. A remote attacker can trick a logged-in=
administrator to open a specially crafted link and execute arbitrary HTML =
and script code in browser in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay "immuniweb" word:
http://[host]/claroline/admin/admin_user_course_settings.php?ccfrom=3Dculis=
t&cidToEdit=3D94102%22%3E%3Cscript%3Ealert%28%27imuniweb%27%29;%3C/script%3=
E&uidToEdit=3D1
1.4 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data in "module_id" HTTP GET parameter passed to "/claroline/admin/modu=
le/module.php" script. A remote attacker can trick a logged-in administrato=
r to open a specially crafted link and execute arbitrary HTML and script co=
de in browser in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay "immuniweb" word:
http://[host]/claroline/admin/module/module.php?module_id=3D4%22%3E%3Cscrip=
t%3Ealert%28%27imuniweb%27%29;%3C/script%3E
1.5 The vulnerability exists due to insufficient sanitisation of user-suppl=
ied data in "offset" HTTP GET parameter passed to "/claroline/admin/right/p=
rofile_list.php" script. A remote attacker can trick a logged-in administra=
tor to open a specially crafted link and execute arbitrary HTML and script =
code in browser in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to di=
splay "immuniweb" word:
http://[host]/claroline/admin/right/profile_list.php?cmd=3DexLock&offset=3D=
0%22%3E%3Cscript%3Ealert%28%27imuniweb%27%29;%3C/script%3E
---------------------------------------------------------------------------=
--------------------
Solution:
Update to Claroline 1.11.9
More Information:
http://forum.claroline.net/viewtopic.php?f=3D88&t=3D26413
http://sourceforge.net/p/claroline/bugs/319/
http://sourceforge.net/p/claroline/code/14574/
---------------------------------------------------------------------------=
--------------------
References:
[1] High-Tech Bridge Advisory HTB23179 - https://www.htbridge.com/advisory/=
HTB23179 - Multiple Cross-Site Scripting (XSS) in Claroline.
[2] Claroline - http://www.claroline.net - Claroline is an Open Source soft=
ware to easily deploy a platform for learning and collaboration online.=20
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - in=
ternational in scope and free for public use, CVE=C2=AE is a dictionary of =
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to =
developers and security practitioners, CWE is a formal list of software wea=
kness types.
[5] ImmuniWeb=C2=AE - http://www.htbridge.com/immuniweb/ - is High-Tech Bri=
dge's proprietary web application security assessment solution with SaaS de=
livery model that combines manual and automated vulnerability testing.
---------------------------------------------------------------------------=
--------------------
Disclaimer: The information provided in this Advisory is provided "as is" a=
nd without any warranty of any kind. Details of this Advisory may be update=
d in order to provide as accurate information as possible. The latest versi=
on of the Advisory is available on web page [1] in the References.