Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Bugtraq ID:	39489
Class:	Input Validation Error
CVE:	CVE-2010-0432
Remote:	Yes
Local:	No
Published:	Apr 14 2010 12:00AM
Updated:	Apr 16 2010 09:23PM
Credit:	Lucas Apa
Vulnerable:	Apache OfBiz 9.04
Not Vulnerable:

Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Apache OFBiz (Open For Business) is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

OFBiz 9.04 is vulnerable; other versions may also be affected.

Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.

The following example URIs and proofs-of-concept are available:

• /data/vulnerabilities/exploits/39489.txt
• /data/vulnerabilities/exploits/39489-1.js
• /data/vulnerabilities/exploits/39489-2.js

Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Apache OFBiz Multiple Cross Site Scripting and HTML Injection Vulnerabilities

References:

• Multiple XSS in Apache OFBiz (Bonsai)
  
• OFBiz Homepage (OFBiz)
  
• [CVE-2010-0432] Apache OFBiz Multiple XSS Vulnerabilities (Jacopo Cappellato )