S21SEC-023 - Vignette multiple Cross Site Scripting vulnerabilities

From: S21SEC (vul-servat_private)
Date: Mon May 26 2003 - 07:13:36 PDT

Next message: Michael Nelson: "Re: bazarr CALL POLICE"

Previous message: S21SEC: "S21SEC-019 - Vignette /vgn/style internal information leak"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

###############################################################
ID: S21SEC-023-en
Title: Multiple Cross Site Scripting vulnerabilities in Vignette
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: HTML code Execution in client browsers
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-023-en.txt
Release: External
###############################################################

                                S 2 1 S E C

                           http://www.s21sec.com

            Multiple Cross Site Scripting vulnerabilities in Vignette


About Vignette
--------------

Vignette develops Content Management and Application Portal Software.


Description of vulnerability
----------------------------

Vignette Software presents multiple Cross Site Scripting vulnerabilities. (XSS)

It's possible to inyect HTML code in text variables. This variables when are showed by a Vignette Application, can execute arbitrary code in the client browser.

Vignette don't offer any protection against this kind of attacks. 

For example this way:

https://www.somesite.es/Page/1,10966,,00.html?var=>alert('s21sec')</script>


Even some default templates are vulnerable to this type of injection:

http://www.somestie.es/vgn/login?errInfo="%2b%20document.cookie%20%2b"


Vignette does not filter any of the "forbidden" HTML chars (<,>,",&)

This vulnerability affects all vignette applications that show input user variables without an explicit filter. Even the default error template is vulnerable.


Affected Versions and platforms
-------------------------------

This vulnerability has been tested in Vignette StoryServer 4 to Vignette V/6. But it seems that all currently avaliable versions are vulnerable.


Solution
--------

Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.



Additional information
----------------------

These vulnerabilities have been found and researched by:

 Ramon Pinuaga Cascales         rpinuagaat_private

You can find the last version of this warning in:

        http://www.s21sec.com/es/avisos/s21sec-023-en.txt

And other S21SEC warnings in http://www.s21sec.com/es/avisos/

Next message: Michael Nelson: "Re: bazarr CALL POLICE"
Previous message: S21SEC: "S21SEC-019 - Vignette /vgn/style internal information leak"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue May 27 2003 - 12:47:55 PDT