BID:36100

Buildbot Multiple Unspecified Cross Site Scripting Vulnerabilities

Info

Buildbot Multiple Unspecified Cross Site Scripting Vulnerabilities

Bugtraq ID:	36100
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 14 2009 12:00AM
Updated:	Aug 24 2009 08:03PM
Credit:	Nicolas Sylvain and Nicolás Alvarez
Vulnerable:	Red Hat Fedora 11 Red Hat Fedora 10 BuildBot BuildBot 0.7.11 BuildBot BuildBot 0.7.10 BuildBot BuildBot 0.7.9 BuildBot BuildBot 0.7.8 BuildBot BuildBot 0.7.7 BuildBot BuildBot 0.7.6 BuildBot BuildBot 0.7.11p2 BuildBot BuildBot 0.7.11p1 BuildBot BuildBot 0.7.10p1

Not Vulnerable:	BuildBot BuildBot 0.7.5 BuildBot BuildBot 0.7.11p3

Discussion

Buildbot Multiple Unspecified Cross Site Scripting Vulnerabilities

Buildbot is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Very few details are available. We will update this BID as more information emerges.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

Buildbot 0.7.6 through 0.7.11p2 are vulnerable.

Exploit / POC

Buildbot Multiple Unspecified Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Solution / Fix

Buildbot Multiple Unspecified Cross Site Scripting Vulnerabilities

Solution:
Updates are available; please see the references for details.

BuildBot BuildBot 0.7.11p1