what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Open Source CERT Security Advisory 2008.12

Open Source CERT Security Advisory 2008.12
Posted Sep 11, 2008
Authored by Will Drewry, Open Source CERT | Site ocert.org

Two cross-site scripting (XSS) vulnerabilities were reported in Horde Framework. The first of which is that the Horde framework fails to properly sanitize the filename of MIME attachments on received emails. The second vulnerability has a wider impact. Horde relies on code similar to Popoon's externalinput.php to filter out potential XSS attacks on user-supplied input. This filter, and the original, fail to fully sanitize user data.

tags | advisory, php, vulnerability, xss
advisories | CVE-2008-3823, CVE-2008-3824
SHA-256 | acda1d56ba4b8127f008b4511f6c73504b17ce52451cced4c4ab5e70aa2f8410

Open Source CERT Security Advisory 2008.12

Change Mirror Download

#2008-012 Horde, Popoon frameworks common input sanitization errors (XSS)

Two cross-site scripting (XSS) vulnerabilities were reported in Horde
Framework. The first of which is that the Horde framework fails to properly
sanitize the filename of MIME attachments on received emails. The second
vulnerability has a wider impact.

Horde relies on code similar to Popoon's externalinput.php to filter out
potential XSS attacks on user-supplied input. This filter, and the original,
fail to fully sanitize user data. In particular, this filter fails to
protect against '/'s acting as spaces in both Microsoft Internet Explorer and
Mozilla Firefox.

Patches have been made available for Horde:

* 3.1:
http://ocert.org/patches/2008-012/Text_Filter.31.patch
* 3.2 - CVS HEAD:
http://ocert.org/patches/2008-012/MIME.patch
http://ocert.org/patches/2008-012/Text_Filter.patch

A replacement for externalinput.php is linked below as well.


Affected version:

Popoon (externalinput.php) <= r22196

Horde >= 3.2, <= 3.2.1 (both issues)
Horde >= 3.1, < 3.2 (XSS filter only)

(secondary affected versions)

Horde Groupware >= 1.0, <= 1.0.6 (XSS filter only)
Horde Groupware Webmail Edition >= 1.0, <= 1.0.7 (XSS filter only)
Horde Groupware >= 1.1, <= 1.1.2 (both issues)
Horde Groupware Webmail Edition >= 1.1, <= 1.1.2 (both issues)
Cake-PHP <= 1.2.0.7296 RC2
phpMyFAQ <= 2.5.0-dev (2008-08-18)
deluxeBB <= 1.2
emucms <= 0.3
SimpleSite <= 1.6.4
RevokeBB <= 1.0RC11_normal
TPLN <= 2.9
Logicoder <= r27
phour <= r106
MDPro <= 1.0821
noserub <= r784/0.6


Fixed version:

Horde > 3.2.1 (see patches)

externalinput/clean.php (see links)


Credit: Vulnerability report and proof of concepts received from
Alexios Fakos <security [at] nruns [dot] com>.


CVE: CVE-2008-3823 (MIME attachment), CVE-2008-3824 (XSS filtering)


Timeline:
2008-08-05: initial report and proof of concepts received.
2008-08-18: affected software survey completed by oCERT.
2008-08-18: externalinput.php/Popoon author contacted.
2008-08-19: Horde author contacted.
2008-08-19: initial patches for Horde and Popoon supplied by vendors.
2008-08-19: reporter calls out additional possible vectors in externalinput.php.
2008-08-20: secondary fixed for externalinput.php supplied.
2008-08-20: attempted to contact CakePHP.
2008-09-04: final Horde patches supplied.
2008-09-04: potentially affected oCERT members and vendor-sec notified.
2008-08-05: CVEs assigned.
2008-09-05: oCERT requests end of embargo to be Sep 10, 1700 UTC.
2008-09-06: contacted phlymail lite; confirmed unaffected.
2008-09-06: notified all secondary vendors above.
2008-09-06: acknowledgement from cakephp, noserub, phpmyfaq.
2008-09-09: confirmed exact embargo end with vendor-sec and other vendors.
2008-09-10: advisory released.

References:
http://blog.liip.ch/archive/2005/01/16/xss-how-we-try-to-prevent-it.html
http://blog.liip.ch/missed-case-in-externalinput-php-resulting-in-viable-xss-attacks.html

Links:
http://horde.org
http://svn.bitflux.ch/repos/public/popoon/trunk/classes/externalinput.php
https://svn.liip.ch/repos/public/ext/externalinput/trunk/lx/externalinput/clean.php
http://horde.org/groupware
http://www.cakephp.org
http://www.phpmyfaq.de
http://www.deluxebb.com
http://www.emusoft.org/index.php?page=category&cat_id=14
http://dev.mistralys.com/SimpleSite
http://sourceforge.net/projects/revokebb
http://tpln.h2lsoft.com/
http://code.google.com/p/logicoder/
http://code.google.com/p/phour/
http://www.maxdev.com/AboutMD.phtml
http://code.google.com/p/noserub/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3823
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3824

Permalink:
http://www.ocert.org.org/advisories/ocert-2008-012.html


--
Will Drewry <redpig@ocert.org>
oCERT Team :: http://ocert.org
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close