Simple Machines Forum Size Tag HTML Injection Vulnerability
BID:10281
Info
Simple Machines Forum Size Tag HTML Injection Vulnerability
| Bugtraq ID: | 10281 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 05 2004 12:00AM |
| Updated: | May 05 2004 12:00AM |
| Credit: | This vulnerability is credited to Cheng Peng Su <[email protected]>. |
| Vulnerable: |
Simple Machines SMF 1.0 -beta5p Simple Machines SMF 1.0 -beta4p Simple Machines SMF 1.0 -beta4.1 |
| Not Vulnerable: | |
Discussion
Simple Machines Forum Size Tag HTML Injection Vulnerability
It has been reported that Simple Machines Forum (SMF) may be prone to an HTML injection vulnerability that may allow an attacker to execute arbitrary HTML or script code in a user's browser. The issue exists due to insufficient sanitization of user-supplied input via the font size attribute.
Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.
It has been reported that Simple Machines Forum (SMF) may be prone to an HTML injection vulnerability that may allow an attacker to execute arbitrary HTML or script code in a user's browser. The issue exists due to insufficient sanitization of user-supplied input via the font size attribute.
Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.
Exploit / POC
Simple Machines Forum Size Tag HTML Injection Vulnerability
No exploit is required for this issue, however Cheng Peng Su <[email protected]> provided some proof-of-concept code.
An attacker could reportedly post content to the forums containing:
[size=expression(alert(document.cookie))]Content[/size]
With the limit that the forum software filters out quotes, apostrophes and semicolons.
Another method that circumvents the software filtering would be to post content such as:
[size=expression(eval(unescape(document.URL.substring(document.URL.length-34,document.URL.length))))]Content[/size]
then get the victim to follow:
http://www.example.com/index.php?topic=12345.0&alert('cookie:\n'+document.cookie)
Where the '12345.0' is the topic containing the previously posted content. The victim's browser would execute the last 34 characters (as specified in the previously posted 'length-34' content).
No exploit is required for this issue, however Cheng Peng Su <[email protected]> provided some proof-of-concept code.
An attacker could reportedly post content to the forums containing:
[size=expression(alert(document.cookie))]Content[/size]
With the limit that the forum software filters out quotes, apostrophes and semicolons.
Another method that circumvents the software filtering would be to post content such as:
[size=expression(eval(unescape(document.URL.substring(document.URL.length-34,document.URL.length))))]Content[/size]
then get the victim to follow:
http://www.example.com/index.php?topic=12345.0&alert('cookie:\n'+document.cookie)
Where the '12345.0' is the topic containing the previously posted content. The victim's browser would execute the last 34 characters (as specified in the previously posted 'length-34' content).
Solution / Fix
Simple Machines Forum Size Tag HTML Injection Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Simple Machines Forum Size Tag HTML Injection Vulnerability
References:
References:
- Simple Machines SMF Homepage (Simple Machines)
- SMF SIZE Tag Script Injection Vulnerability (Cheng Peng Su