Antville 1.1 Cross Site Scripting

[Moritz Naumann]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



SA0004

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++
+++++ Antville 1.1 Cross Site Scripting +++++
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++


PUBLISHED ON
Nov 09, 2005


PUBLISHED AT
http://moritz-naumann.com/adv/0004/antvxss/0004.txt
http://moritz-naumann.com/adv/0004/antvxss/0004.txt.sig


PUBLISHED BY
Moritz Naumann IT Consulting & Services
Hamburg, Germany
http://moritz-naumann.com/

info AT moritz HYPHON naumann D0T com
GPG key: http://moritz-naumann.com/keys/0x277F060C.asc


AFFECTED APPLICATION OR SERVICE
Antville
http://www.antville.org/


AFFECTED VERSION
Version 1.1
Possibly versions 1.0 and lower (untested)


BACKGROUND
Everybody knows XSS.
http://en.wikipedia.org/wiki/XSS
http://www.cgisecurity.net/articles/xss-faq.shtml


ISSUE
A XSS vulnerability has been detected in Antville. The
problem is caused by insufficient input sanitation.

By making a victim visit a specially crafted URL, it is
possible to inject client side scripting (such as
Javascript) and HTML which will be executed/rendered in
her browser.

The following URL demonstrates this issue:
[antville_basepath]/project/<script>alert('XSS');</script>

This may not be easily exploitable for cookie/session
stealing attacks due to the IP address lock on the session.


WORKAROUND
Client: Disable Javascript.
Server: Prevent access to the Antville installation.


SOLUTIONS
There does not seem to be a patch available. Our attempts
to contact the developers were unsuccessful.


TIMELINE
Sep 19, 2005 Discovery
Sep 19, 2005 Code maintainer notification
Sep 29, 2005 Another code maintainer notification
Nov 09, 2005 Public disclosure


REFERENCES
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3530


ADDITIONAL CREDIT
N/A


LICENSE
Creative Commons Attribution-ShareAlike License Germany
http://creativecommons.org/licenses/by-sa/2.0/de/



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDcijWn6GkvSd/BgwRAt1GAJwKCc/BKl9UKEGc4gNH3iO61em0xQCggqKG
vr3wn/zqL0VwrGk/rEqhbR0=
=s8WY
-----END PGP SIGNATURE-----