Sitecore CMS 'url' Parameter URI Redirection Vulnerability

Bugtraq ID:	48930
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 28 2011 12:00AM
Updated:	Jul 28 2011 12:00AM
Credit:	Tom Neaves
Vulnerable:	Sitecore Sitecore CMS 5.4 rev 091111 Sitecore Sitecore CMS 5.4 rev 080625 Sitecore Sitecore CMS 6.4.1 rev. 110324 Sitecore Sitecore CMS 6.0.2 rev. 090507 Sitecore Sitecore CMS 6.0.0 rev. 090120 Sitecore Sitecore CMS 5.3.2 rev. 090212 Sitecore Sitecore CMS 5.3.2 rev. 081002 Sitecore Sitecore CMS 5.3.1 rev. 071114
Not Vulnerable:	Sitecore Sitecore CMS 6.4.1 rev.110720

Sitecore CMS 'url' Parameter URI Redirection Vulnerability

Sitecore CMS is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks.

Sitecore CMS versions 6.4.1 rev. 110324 and prior are vulnerable.

Sitecore CMS 'url' Parameter URI Redirection Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to following a malicious URI.

The following example URI is available:

http://www.example.com/sitecore/shell/default.aspx?xmlcontrol=Application&url=http://www.example.com&ch=WindowChrome&ic=Applications%2f32x32%2fabout.png&he=About+Sitecore&ma=0&mi=0&re=0

Sitecore CMS 'url' Parameter URI Redirection Vulnerability

Solution:
Updates are available. Please see the references for details.

Sitecore CMS 'url' Parameter URI Redirection Vulnerability

References:

• Sitecore CMS 6.4 (Tom Neaves)
  
• Sitecore CMS Homepage (Sitecore)
  
• Sitecore CMS 6.4 Open URL Redirect Vulnerability (Tom Neaves )