STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability

STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability

Revision 1.1
Date Published: 2004-11-22 (KST)
Last Update: 2004-11-22
Disclosed by SSR Team (advisory@stgsecurity.com)

Summary
========
Zwiki is a wiki clone in zope. It has a cross site scripting vulnerability.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Details
=======
Due to an input validation flaw, the Zwiki is vulnerable to cross site
scripting attacks.

cf. http://zwiki.org/925ZwikiXSSVulnerability

proof of concept
http://[victim]/<img src=javascript:alert('hi')>

Impact
======
Medium: Malicious attackers can inject and execute arbitrary script code in
a user's browser session in context of an affected site.

Workaround
==========
There is no known workaround at this time.

Affected Products
================
Zwiki 0.36.2 and prior

Vendor Status: NOT FIXED
=======================
2004-10-01 Vulnerability found.
2004-10-01 Zwiki developer notified.
2004-11-22 Official release.

Credits
======
Jeremy Bae at STG Security

[Chris Withers]

advisory@stgsecurity.com wrote:

> proof of concept
>
> http://[victim]/<img src=javascript:alert('hi')>

Just to note, this bug only affects ZWiki version after Zwiki 0.10.0rc1.

Also, the fix is pretty trivial, apply the following patch to
standard_error_message in all ZWiki folders (and on disk, so you don't
have to do it again ;-):

--- standard_error_message.dtml.original Fri Nov 26 09:17:22 2004
+++ standard_error_message.dtml Fri Nov 26 09:17:55 2004
@@ -29,7 +29,7 @@
<body>
<p>
I could not find any likely page matching
- "<b><dtml-var "here.urlunquote(searchexpr)"></b>"
+ "<b><dtml-var "here.urlunquote(searchexpr)" html_quote></b>"
</p>
<p>
Click here to

Sadly, I see I broke the bug tracker, 'cos it's also a ZWiki, and has
MUCH bigger problems than the above :-S (execution of any DTML in the
context of (hopefully!) the user that created it along with a total lack
of html quoting in the page :-(

In short, only use ZWiki if you know what you're doing, and preferably
only if it's not anonymously accessible...

*sigh*

Chris

--
Simplistix - Content Management, Zope & Python Consulting
- http://www.simplistix.co.uk