oss-security - Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <50E19DC2.60608@moritz-naumann.com>
Date: Mon, 31 Dec 2012 15:14:26 +0100
From: Moritz Naumann <oss-security@...itz-naumann.com>
To: oss-security@...ts.openwall.com
CC: henri@...v.fi, security@...plemachines.org, irist.ir@...il.com
Subject: Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter
 XSS

On 31.12.2012 11:42 Henri Salo wrote:
[..]
> Until someone provides a working PoC I dispute this issue. SMF hasn't replied to my emails about this. Please note there is several comments[1][2] in forums about this too.
> 
[..]
> It's not a security vulnerability if attacker already has administrator access to the application. Should we REJECT CVE-2012-5903?

Based on the authors' description it would seem more likely that the
attack would use social engineering to trick the legitimate forum admin
into accessing this URL with a payload in it, which would then trigger
in his browser and disclose the admins' session cookie to an attacker by
means of cross site scripting. Like you, I don't see how the value
passed to the "scheduled" parameter would be echoed out, though.

While it doesn't directly impact treatment of this latest report, I'd
like to point out that there has been a previous report by the same
author on the same product back in october, which I was also unable to
reproduce:

From:    irist.ir@...il.com
To:      bugtraq@...urityfocus.com
Date:    Tue, 23 Oct 2012 19:20:10 GMT
Subject: Smf 2.0.2 Cross-Site Scripting Vulnerability

# Exploit Title : Smf 2.0.2 Cross-Site Scripting Vulnerability
#
# Author        : IrIsT.Ir
#
# Discovered By : Am!r

http://packetstormsecurity.com/files/117618/SMF-2.0.2-Cross-Site-Scripting.html


Same for a supposed vulnerability in Wordpress which was reported the
day after:

From:    irist.ir@...il.com
To:      bugtraq@...urityfocus.com
Subject: Wordpress 3.4 Cross-Site Scripting Vulnerability

# Exploit Title : Wordpress 3.4 Cross-Site Scripting Vulnerability
#
# Author        : IrIsT.Ir
#
# Discovered By : Am!r



I contacted the sender address back then, pointing out that:

> it's an XSS if the application returns the input in an unencoded way,
> allowing an attacker (or victim) to inject script code into the
> applications output. I don't see how this is the case with the SMF or
> Wordpress code you quoted.

I have not received a reply.

Moritz

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.