=====================================================================
 Joomla! Component com_bc Cross Script Scripting (XSS) Vulnerability
=====================================================================


1. OVERVIEW

The Joomla! Component com_bc was vulnerable to Cross Script Scripting
(XSS) Vulnerability.


2. PRODUCT DESCRIPTION

The Joomla! Component com_bc is a widely-used Blastchat chat server
component designed for website communities
from the smallest personal websites to the huge megasites who desire
to provide their members and visitors
with a superb chat experience. BlastChat has currently been serving
chat to over 50.000+ websites.


3. VULNERABILITY DESCRIPTION

The Joomla! Component com_bc does not properly escape parameters:-
ctask, bcItemid, lang, nlang , rid, rsid, sec_code, template, and
usergid.
This leads to Cross Site Scripting vulnerability. For more information
about this kind of vulnerability, see OWASP Top 10 - A2, WASC-8 and
CWE-79: Improper Neutralization of Input During Web Page Generation
('Cross-site Scripting').


4. VERSIONS AFFECTED

Versions Not Available (reason: Closed-source/Commercial Product)


5. PROOF-OF-CONCEPT/EXPLOIT

Vulnerable URL-1:
index2.php?option=com_bc&no_html=1&task=load&ctask=enter&d=1&url=[victim_url]&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&&sec_code=[]&time_key=2010-08-11%2003:46:00&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=20&detaching=1

Vulnerable URL-2:
index2.php?option=com_bc&no_html=1&task=client&ctask=enter&d=0c39e7&url=[victim_url&intraid=[]&userid=0&usergid=0&nick=&rid=0&rsid=0&lang=english&nlang=en-GB&template=system&pub_key=[]&sec_code=[]&time_key=2010-08-11%2018:45:20&bcItemid=&bc_ver=3.2&prod=Joomla!&rel=1.5&dev=7
Affected parameters: d , no_html, ctask, bcItemid, lang, nlang , rid,
rsid, sec_code, template, usergid

http://yehg.net/lab/pr0js/advisories/joomla/com_bc_xss(rid).jpg


6. IMPACT

As this is a multi-user chat application "component", the impact of
XSS is huge, ranking from cookie theft to mass client exploits.


7. SOLUTION

Reported vulnerabiltiy was fixed at 08-15-2010. It is now supposed to be safe.
It is suggested that any web sites that use this component ask the
vendor for the updated version.


8. VENDOR

Blastchat
http://www.blastchat.com


9. CREDIT

This vulnerability was discovered by Aung Khant, http://yehg.net, YGN
Ethical Hacker Group, Myanmar.


10. DISCLOSURE TIME-LINE

08-11-2010: discovered vulnerability
08-11-2010: notified vendor
08-15-2010: vendor fixed vulnerability
08-26-2010: vulnerability disclosed


11. REFERENCES

Original Advisory URL:
http://yehg.net/lab/pr0js/advisories/joomla/[com_bc]_cross_site_scripting
What XSS Can Do: http://yehg.net/lab/pr0js/view.php/What%20XSS%20Can%20Do.pdf
XSS FAQs: http://www.cgisecurity.com/articles/xss-faq.shtml
XSS (wiki): http://en.wikipedia.org/wiki/Cross-site_scripting
XSS (owasp): http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
OWASP Top 10: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
CWE-79: http://cwe.mitre.org/data/definitions/79.html

#yehg [08-26-2010]

---------------------------------
Best regards,
YGN Ethical Hacker Group
Yangon, Myanmar
http://yehg.net
Our Lab | http://yehg.net/lab
Our Directory | http://yehg.net/hwd