exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

sitekiosk-xss.txt

sitekiosk-xss.txt
Posted Dec 15, 2006
Authored by Brett Moore SA | Site security-assessment.com

SiteKiosk versions below 6.5.150 suffer from a validation input flaw that allows for cross site scripting and arbitrary filesystem access.

tags | advisory, arbitrary, xss
SHA-256 | 9ea3f03a84207ff83790149a9ca0b630607738fb4f06654ce25f61c61a9518ee

sitekiosk-xss.txt

Change Mirror Download
Still time before Christmas.

========================================================================
= SiteKiosk - FileSystem Access
=
= Vendor Website:
= http://www.sitekiosk.com/
=
= Affected Software:
= SiteKiosk < 6.5.150
=
= Public disclosure on Tuesday December 12, 2006
========================================================================

== Overview ==

SiteKiosk is an application used to secure public access terminals. It
is
designed to provide a safe and stable way for the use of public access
terminals with or without access to the Internet.

SiteKiosk is based on Internet Explorer and can be configured to
individually restrict access to Web sites, the operating system,
system settings, and applications. Your computer will be protected
against
any manipulation from the time you boot until you shut it down.

SiteKiosk suffers from a cross site scripting vulnerability, that leads
to filesystem access.

== Exploitation ==

SiteKiosk implements a 'skinning' feature so that the layout and display

of the browser can be modified. The 'skinning' feature uses an HTML
aware
control for the modified title bar of the main SiteKiosk window.

SiteKiosk displays the URL of the current location in the title bar of
the main window, and therefore any HTML code in the location will be
included in the title bar.

By default, SiteKiosk does not properly handle the ABOUT: prefix. The
URL
is directly outputted to the screen leading to a normal cross site
scripting
vulnerability.

Because the URL is also outputted to the title bar, script can be
executed
under the LOCAL computer zone.

If a user types the following into the address box, or browses a site
that
sets the location to; ABOUT:hello<a href=\>click here</a>

The title bar will display a hyperlink. By clicking on this HREF in the
main windows title bar, the filesystem will be accessed with an explorer
window.

SiteKiosk also installs some activeX controls that are marked 'safe
for scripting'. One of these controls exposes two dangerous methods that
allow a SiteKiosk user to read and download any file from the kiosk
with the permissions of the user running SiteKiosk.

== Solutions ==

A new version of SiteKiosk has been released that addresses these
vulnerabilities. It can be downloaded from http://www.sitekiosk.com.

== Credit ==

Discovered and advised to SiteKiosk November 30, 2006 by Brett Moore of
Security-Assessment.com

== About Security-Assessment.com ==

Security-Assessment.com is Australasia's leading team of Information
Security consultants specialising in providing high quality Information
Security services to clients throughout the Asia Pacific region. Our
clients include some of the largest globally recognised companies in
areas such as finance, telecommunications, broadcasting, legal and
government. Our aim is to provide the very best independent advice and
a high level of technical expertise while creating long and lasting
professional relationships with our clients.

Security-Assessment.com is committed to security research and
development, and its team continues to identify and responsibly publish
vulnerabilities in public and private software vendor's products.
Members of the Security-Assessment.com R&D team are globally recognised
through their release of whitepapers and presentations related to new
security research.

Security-Assessment.com is an Endorsed Commonwealth Government of
Australia supplier and sits on the Australian Government
Attorney-General's Department Critical Infrastructure Project panel.
We are certified by both Visa and MasterCard under their Payment
Card Industry Data Security Standard Programs.
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close