oss-security - CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <510714A1.6090501@moritz-naumann.com>
Date: Tue, 29 Jan 2013 01:15:29 +0100
From: Moritz Naumann <security@...itz-naumann.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")

Hi,

Elgg [1], versions 1.8.12 and 1.7.16 and earlier, bears a persistent
script injection vulnerability in its core module "Twitter widget",
which allows for XSS attacks.

On installations which have the Twitter widget activated (disabled by
default, but in use on many installations), any authenticated user may
add the Twitter widget to their activity / dashboard page. Editing its
configuration allows the user to set the twitter_username parameter. The
value stored in this parameter will be echoed without sanitation [2]
when the users' activity / dashboard page is requested (by the same or
any other user, authenticated or not).

According to changes committed [3] to their Git repository Elgg
developers will provide a fix for this issue in the upcoming (?) 1.8.13
release.

Reported by:
  Moritz Naumann
  http://moritz-naumann.com

A CVE ID has, to my knowledge, not yet been assigned. Secunia has
assigned it SA52007.

A slightly more complete advisory should hit FD and Bugtraq any minute.

Thanks,

Moritz

[1] http://elgg.org/
[2]
http://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21
[3]
http://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.