#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# CVE ID : CVE-2013-0805
# CSNC ID: CSNC-2013-001
# Product: iTop
# Vendor:  Combodo
# Subject: Cross-site Scripting - XSS
# Risk:    High
# Effect:  Remotely exploitable
# Author:  Stephan Rickauer (stephan.rickauer _at_ csnc.ch)
# Date:    January 23rd 2013
#
#############################################################


Introduction:
-------------
Compass Security discovered a security flaw in the iTop web application.


Vulnerable:
-----------
All iTop versions older than:
* trunk revision 2589
* branches/1.2.1, revision 2587
* branches/1.2, revision 2588
* branches/2.0, revision 2590


Not vulnerable:
---------------
unknown


Patches:
--------
Patches have been commited to the SourceForge Trac by the vendor with 
respect
to all affected versions. Modified files: pages/UI.php and 
pages/run_query.php


Fix:
----
Thoroughly encode all user input properly on output.


Description:
------------
The iTop search feature displays the term entered by the user. However, that
very output of the user's input happens mostly un-encoded. The implemented
mitigation step of only encoding < as part of a script tag is inadequate and
can be easily bypassed. Exploiting this vulnerability will lead to so-called
cross-site scripting (XSS) and allows the impersonation of logged-in iTop
users.


Milestones:
-----------
January 4th,  Vulnerability discovered
January 4th,  Vendor contact established
January 7th,  Vendor provided with technical details
January 7th,  Vendor acknowledged issue (support _at_ combodo.com)
January 15th, CVE assigned and vendor notified
January 23rd, Patch committed in all main branches of the iTop project 
by vendor
January 23rd, Public release of advisory


References:
-----------
XSS reference:
http://en.wikipedia.org/wiki/Cross-site_scripting
Cross-site scripting (XSS) is a type of computer security vulnerability
typically found in web applications which allow code injection by malicious
web users into the web pages viewed by other users. Examples of such code
include HTML code and client-side scripts. An exploited cross-site scripting
vulnerability can be used by attackers to bypass access controls such as the
same origin policy. Recently, vulnerabilities of this kind have been 
exploited
to craft powerful phishing attacks and browser exploits. Cross-site 
scripting
was originally referred to as CSS, although this usage has been largely
discontinued.

iTop reference:
http://www.combodo.com/iTop-a-new-generation-of-IT.html

Provided evidence:
- Two screenshots
- XSS attack code
- copy of html page showing unencoded output