{"id":20285,"date":"2023-06-16T12:53:11","date_gmt":"2023-06-16T10:53:11","guid":{"rendered":"https:\/\/herolab.usd.de\/19999-2\/"},"modified":"2023-06-30T13:51:29","modified_gmt":"2023-06-30T11:51:29","slug":"usd-2022-0011","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0011\/","title":{"rendered":"usd-2022-0011"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.21.0\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n<h1><\/h1>\n<p>&nbsp;<\/p>\n<h1>usd-2022-0011 | Stored XSS in Foswiki<\/h1>\n<p><span><\/span><\/p>\n<p><strong>Advisory ID:<\/strong> usd-2022-0011<br \/><strong>Product:<\/strong> Foswiki<br \/><strong>Affected Version:<\/strong> 2.1.7<br \/><strong>Vulnerability Type: CWE-79:<\/strong> Improper Neutralization of Input During Web Page Generation<br \/><strong>Security Risk:<\/strong> High<br \/><strong>Vendor URL:<\/strong> <a>https:\/\/foswiki.org<\/a><br \/><strong>Vendor acknowledged vulnerability:<\/strong> Yes<br \/><strong>Vendor Status:<\/strong> Fixed<br \/><strong>Advisory Status:<\/strong> closed<br \/><strong>Last Update:<\/strong> 2022-06-09<\/p>\n<h2>Description<\/h2>\n<p><span><span class=\"ui-provider gs b c d e f g h i j k l m n o p q r s t u v w x y z ab ac ae af ag ah ai aj ak\" dir=\"ltr\">Foswiki is a free and open-source wiki application that allows collaborative editing and content management. It is written in Perl programming language.<br \/>The application allows users to add attachments to wiki pages and add comments to the files.\u00a0<br \/><\/span><\/span><\/p>\n<h2>Proof of Concept<\/h2>\n<p>The application does not properly validate user supplied input. A wiki user can inject javascript code into the <em>comment<\/em> field of an attachment.<br \/>This payload is executed whenever a user visits the page where is attachment is attached to.To reproduce the vulnerability, the \"filecomment\" POST parameter is set as follows: \"filecomment=&lt;img onerror=\"alert(document.domain)\" src=\"X\"\/&gt;\"<\/p>\n<p>In the following, an exemplary HTTP request is given:<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span><span class=\"nf\" style=\"background: #263238;color: #82aaff\">POST<\/span> <span class=\"nn\" style=\"background: #263238;color: #ffcb6b\">\/bin\/rest\/TopicInteractionPlugin\/changeproperties<\/span> <span class=\"kr\" style=\"background: #263238;color: #bb80b3\">HTTP<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">\/<\/span><span class=\"m\" style=\"background: #263238;color: #f78c6c\">1.1<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Host<span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">localhost<\/span>\nCookie<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> [...]\n\nvalidation_key=c13461712d0b773bfb7508f15b88502b&amp;id=save&amp;origfilename=emblem-readonly.png&amp;topic=Main.WebHome&amp;filename=emblem-readonly.png&amp;filecomment=%3Cimg+src%3D%2FX+onerror%3Dalert(document.domain)%3E<\/pre>\n<\/div>\n<p>&nbsp;<\/p>\n<p>The payload is triggered, when a user is visiting a page where the file is attached:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/04\/foswiki.xss_.png\" alt=\"\" class=\"wp-image-20017 alignnone size-full\" width=\"955\" height=\"436\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/04\/foswiki.xss_.png 955w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/04\/foswiki.xss_-480x219.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 955px, 100vw\" \/><\/p>\n<h2>Fix<\/h2>\n<p>It is recommended to treat all input on the website as potentially dangerous. Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context. The majority of programming languages support standard procedures for encoding meta characters. For example, PHP has the built-in function <em>htmlspecialchars()<\/em>.<\/p>\n<h2>References<\/h2>\n<ul>\n<li><a>https:\/\/cwe.mitre.org\/data\/definitions\/79.html<\/a><\/li>\n<\/ul>\n<h2>Timeline<\/h2>\n<ul>\n<li><strong>2022-01-05:<\/strong> Vulnerability identified by Christian P\u00f6schl<\/li>\n<li><strong style=\"font-size: 16px\">2022-04-27<\/strong><strong>: <\/strong>First contact request made to the vendor<\/li>\n<li><strong>2022-05-05:<\/strong> Second contact request made to the vendor<\/li>\n<li><strong>2022-06-09:<\/strong> Share vulnerability details with vendor<\/li>\n<li><strong>2022-06-09:<\/strong> Fix released by vendor<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2>Credits<\/h2>\n<p>This security vulnerability was found by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; usd-2022-0011 | Stored XSS in Foswiki Advisory ID: usd-2022-0011Product: FoswikiAffected Version: 2.1.7Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page GenerationSecurity Risk: HighVendor URL: https:\/\/foswiki.orgVendor acknowledged vulnerability: YesVendor Status: FixedAdvisory Status: closedLast Update: 2022-06-09 Description Foswiki is a free and open-source wiki application that allows collaborative editing and content management. It is written [&hellip;]<\/p>\n","protected":false},"author":109,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-20285","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/109"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=20285"}],"version-history":[{"count":6,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20285\/revisions"}],"predecessor-version":[{"id":20483,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/20285\/revisions\/20483"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=20285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}