1. OVERVIEW

Fastpath WebChat is vulnerable to Cross Site Scripting.


2. BACKGROUND

Fastpath WebChat is part of the Fastpath product. It provides a way
for users to begin chatting with support agents using Fastpath.
Fastpath is a plugin of OpenFire, a real time collaboration (RTC)
server for instant messaging.  Fastpath provides queuing and routing
for instant messaging to intelligently link people together.


3. VULNERABILITY DESCRIPTION

Multiple parameters were not properly sanitized, which allows attacker
to conduct Cross Site Scripting attack. This may allow an attacker to
create a specially crafted URL that would execute arbitrary script
code in a victim's browser.


4. VERSIONS AFFECTED

4.0.0 (released date: Aug 5, 2008)


5. VULNERABLE PARAMETERS

File: webapp/agentinfo.jsp  
Parameters: agentName, emailValue, jid, nameValue, title

File: webapp/chat-ended.jsp     
Parameter: workgroup

File: webapp/chatmain.jsp  
Parameters: chatID, workgroup

File: webapp/chatroom.jsp  
Parameters: email, jid, userNickname, question

File: webapp/contact-agent.jsp  
Parameter: email

File: webapp/email/leave-a-message.jsp  
Parameter: workgroup  

File: webapp/email/offline-mail.jsp     
Parameter: workgroup

File: webapp/queue_updater.jsp     
Parameters: chatID, workgroup  

File: webapp/style.jsp
Parameter:    workgroup  

File: webapp/transcriptmain.jsp  
Parameters:   chatID, workgroup

File: webapp/transcriptsrc.jsp
Parameters:  from, text


6. SOLUTION

Fastpath WebChat is no longer in active development.
Ref: http://www.igniterealtime.org/projects/openfire/plugins.jsp
Ref: http://fisheye.igniterealtime.org/browse/svn-org/openfire/trunk/src/plugins/fastpath/src/web


7. VENDOR

Jive Software
http://www.jivesoftware.com/


8. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.


9. DISCLOSURE TIME-LINE

2012-04-15: vulnerability disclosed


10. REFERENCES

Original Advisory URL:
http://yehg.net/lab/pr0js/advisories/%5Bfastpath-webchat%5D_multiple_cross_site_scripting
What XSS Can Do: http://yehg.net/lab/pr0js/view.php/What%20XSS%20Can%20Do.pdf
XSS FAQs: http://www.cgisecurity.com/articles/xss-faq.shtml
XSS (wiki): http://en.wikipedia.org/wiki/Cross-site_scripting
XSS (owasp): http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
OWASP Top 10: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
CWE-79: http://cwe.mitre.org/data/definitions/79.html


#yehg [2012-04-15]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd