The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple DotNetNuke Cross Site Scripting (XSS)
------------------------------------------------------------------------
SUMMARY
<http://www.dotnetnuke.com/> DotNetNuke is "an Open Source hybrid of the
IBuySpy Portal. Its management team is dedicated to the ongoing management
of core portal application enhancements. DotNetNuke provides automated
content management capabilities and tools to maintain a dynamic and 100%
interactive data-driven web site". Multiple cross site scripting
vulnerabilities have been discovered in DotNetNuke.
DETAILS
Vulnerable Systems:
* DotNetNuke version 3.0.11 and prior
Immune Systems:
* DotNetNuke version 3.0.12 or newer
Issue 1 (XSS)
There is a vulnerability caused by the lack of input validation when
registering a new user within a DotNetNuke portal. An attacker could use a
cross site scripting (XSS) attack when registering a new user, when the
View All User Details page the malicious code will be executed, resulting
in the capture of Administrative session credentials.
Issue 2 (Secondary Attack Vector XSS)
The User-Agent string sent with each request is stored for logging
purposes. This data comes from the client and cannot be trusted, and
therefore must be sanitized. An attacker could set the User-Agent string
for the request to malicious script code, which would be logged and
executed when any logs are viewed that contain the User-Agent field. This
attack can be utilized by an unauthenticated user simply requesting the
root page.
Issue 3 (Secondary Attack Vector XSS)
The failed logon username is stored and displayed on the Log Viewer page.
An attacker can send a logon request with malicious script set as the
parameter value, the script passed in the parameter will be executed when
an Administrative user views the Log Viewer page or any log page that
displays the failed logon username.
Vendor Response:
05-01-2005 Contacted core development team via email
10-01-2005 Response from vendor received and confirmed
10-01-2005 Second mail sent regarding more issues
13-01-2005 Sent email asking for confirmation of second email (No vendor
response)
12-03-2005 DotNetNuke v3.0.12 released (All reported security issues
fixed)
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0040>
CAN-2005-0040
ADDITIONAL INFORMATION
The information has been provided by <mailto:m.woan@eris.qinetiq.com>
Mark Woan.
The original article can be found at:
<http://www.woany.co.uk/advisories/dotnetnukexss.txt>
http://www.woany.co.uk/advisories/dotnetnukexss.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
