KnowledgeTree OSS 3.0.3b Application Reflected XSS (Cross-site Scripting) Web Security 0Day Vulnerability

KnowledgeTree OSS 3.0.3b Application Reflected XSS (Cross-site Scripting) Web Security 0Day Vulnerability

Exploit Title: KnowledgeTree login.php &errorMessage parameter Reflected XSS Web Security Vulnerability

Product: Knowledge Tree Document Management System

Vendor: Knowledge Inc

Vulnerable Versions: OSS 3.0.3b

Tested Version: OSS 3.0.3b

Advisory Publication: August 22, 2015

Latest Update: August 31, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference:

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

 

 

Caution Details:

(1) Vendor & Product Description:

Vendor:

KnowledgeTree

Product & Vulnerable Versions:

Knowledge Tree Document Management System

OSS 3.0.3b

Vendor URL & Download:

Product can be obtained from here,

http://download.cnet.com/KnowledgeTree-Document-Management-System/3000-10743_4-10632972.html

http://www.knowledgetree.com/

Product Introduction Overview:

"KnowledgeTree is open source document management software designed for business people to use and install. Seamlessly connect people, ideas, and processes to satisfy all your collaboration, compliance, and business process requirements. KnowledgeTree works with Microsoft® Office®, Microsoft® Windows® and Linux®."

(2) Vulnerability Details:

KnowledgeTree web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. KnowledgeTree has patched some of them. "Bugtraq is an electronic mailing list dedicated to issues about computer security. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It is a high-volume mailing list, and almost all new vulnerabilities are discussed there.". It has listed similar exploits, such as Bugtraq (Security Focus) 32920.

(2.1) The code flaw occurs at "&errorMessage" parameter in "login.php" page.

One similar bug is CVE-2008-5858. Its X-Force ID is 47529.

References:
http://seclists.org/oss-sec/2015/q3/458

http://tetraph.com/security/xss-vulnerability/knowledgetree-oss-3-0-3b-reflected-xss/

https://progressive-comp.com/?l=oss-security&m=144094021709472
http://webtech.lofter.com/post/1cd3e0d3_806e1d4

http://itinfotech.tumblr.com/post/128016383831/knowledge-tree-xss

http://germancast.blogspot.com/2015/08/knowledge-tree-xss.html

http://permalink.gmane.org/gmane.comp.security.oss.general/17655

https://infoswift.wordpress.com/2015/08/31/knowledge-tree-xss/
http://japanbroad.blogspot.jp/2015/08/knowledge-tree-bug-exploit.html
http://marc.info/?l=full-disclosure&m=144099659719456&w=4
http://tetraph.blog.163.com/blog/static/234603051201573144123156/
http://www.openwall.com/lists/oss-security/2015/08/30/2
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg02446.html

CVE-2014-8754 WordPress "Ad-Manager Plugin" Unvalidated Redirects and Forwards Web Security Vulnerability

CVE-2014-8754 WordPress "Ad-Manager Plugin" Unvalidated Redirects and Forwards Web Security Vulnerability



Exploit Title: WordPress Ad-Manager Plugin Unvalidated Redirects and Forwards Vulnerability
Product: WordPress Ad-Manager Plugin
Vendor: CodeCanyon
Vulnerable Versions: 1.1.2
Tested Version: 1.1.2
Advisory Publication: November 25, 2014
Latest Update: December 15, 2014
Vulnerability Type: URL Redirection to Untrusted Site  [CWE-601]
CVE Reference: CVE-2014-8754
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)
Impact Subscore: 4.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification

Writer and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:


(1) Vendor & Product Description:


Vendor:
CodeCanyon



Product & Vulnerable Versions:
WordPress Ad-Manager Plugin
1.1.2



Vendor URL & Download:
Product can be obtained from here,
http://codecanyon.net/item/wordpress-admanager/544421





Product Introduction Overview:
"Wordpress Ad-Manager offers you a simple solution to implement advertising into your posts, your blog or any other Wordpress page. You can use pictures and images or HTML snippets like Google AdSense to incorporate advertising in an easy way. You are able to select ads via Ad Zones, to re-size them or to limit the height or the width. Wordpress Ad-Manager also offers statistics for the site admin. However, Wordpress Ad-Manager’s best feature is its simplicity. It’s easy to set up and also comes with a widget. What more could one want?"



(2) Vulnerability Details:
Ad-Manager Plugin web application has a computer cyber security problem. Hacker can exploit it by Unvalidated Redirects and Forwards (URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks  are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

Several other similar products 0-day vulnerabilities have been found by some other bug hunter researchers before. Ad-Manager Plugin has patched some of them. The Full Disclosure mailing list is a public forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. FD differs from other security lists in its open nature and support for researchers' right to decide how to disclose their own discovered bugs. The full disclosure movement has been credited with forcing vendors to better secure their products and to publicly acknowledge and fix flaws rather than hide them. Vendor legal intimidation and censorship attempts are not tolerated here! It also publishs suggestions, advisories, solutions details related to Open Redirect vulnerabilities and cyber intelligence recommendations.


(2.1) The Dest Redirect Privilege Escalation code flaw occurs at "track-click.php" page with "&out" parameter.










References:
http://tetraph.com/security/cves/cve-2014-8754
http://computerobsess.blogspot.com/2014/12/cve-2014-8754-wordpress-ad-manager.html
http://www.cnnvd.org.cn/vulnerability/show/cv_id/2014110533
http://seclists.org/fulldisclosure/2014/Nov/93
http://www.osvdb.org/creditees/12822-wang-jing
https://progressive-comp.com/?l=full-disclosure&m=141705602927943&w=1
https://packetstormsecurity.com/files/129290/WordPress-Ad-Manager
http://cxsecurity.com/issue/WLB-2014120003
http://www.cnvd.org.cn/flaw/show/CNVD-2014-08598
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01370.html
http://russiapost.blogspot.com/2014/12/wordpress-ad-manager-open-redirect.html
http://marc.info/?l=full-disclosure&m=141705602927943&w=4

CVE-2014-7292 Newtelligence dasBlog Dest Redirect Privilege Escalation Web Application Zero Day Bug

 

Exploit Title: Newtelligence dasBlog Dest Redirect Privilege Escalation Vulnerability

Product: dasBlog

Vendor:  Newtelligence

Vulnerable Versions: 2.3 (2.3.9074.18820) 2.2 (2.2.8279.16125) 2.1(2.1.8102.813)

Tested Version: 2.3 (2.3.9074.18820)

Advisory Publication: OCT 15, 2014

Latest Update:   OCT 15, 2014

Vulnerability Type: URL Redirection to Untrusted Site ('Open Redirect') [CWE-601]

CVE Reference: *

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 5.8 (MEDIUM) (AV:N/AC:M/Au:N/C:P/I:P/A:N) (legend)

Impact Subscore: 4.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification

Writer and Reporter: Jing Wang [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Proposition Details:

(1) Vendor & Product Description:

Vendor:

Newtelligence

Product & Vulnerable Versions:

dasBlog

2.3 (2.3.9074.18820) 2.2 (2.2.8279.16125) 2.1(2.1.8102.813)

Vendor URL & download:

dasBlog can be obtained from here,

http://dasblog.codeplex.com/documentation

What is dasBlog?
"dasBlog Community Edition is an ASP.NET weblogging application. It runs on ASP.NET 1.1 and is developed in C#. dasBlog, an evolution of the BlogX weblog engine, adds lots of additional features like Trackback, Pingback, Mail notifications, full Blogger/M."

"This dasBlog 2.3.1 release comes almost 3 years since the release of dasBlog 2.3, we know this is an internet lifetime, and in many cases our user base may have moved on to other applications, (and/or are just checking back in to see what we have to offer, or you stuck with us and you may be outgrowing your current dasBlog installation! That said, if this is your first experience with dasBlog or you’re looking for improvements in your current dasBlog, you will find that dasBlog 2.3.1 is an incremental improvement, now supporting .NET 4 and resolving some minor support operations issues, and is even more robust and stable than it ever has been. What you will not find is a host of new features or much expansion of the existing features."









(2) Advisory Details:
Newtelligence dasBlog ct.ashx is vulnerable to Open Redirect attacks. Hacker can exploit it by Unvalidated Redirects and Forwards (Open Redirect or URL Redirection) attacks. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

dasBlog supports a feature called Click-Through which basically tracks all links clicked inside your blog posts. It's a nice feature that allows the blogger to stay informed what kind of content readers like. If Click-Through is turned on, all URLs inside blog entries will be replaced with <URL to your blog>/ct.ashx?id=<Blog entry ID>&url=<URL-encoded original URL> which of course breaks WebSnapr previews.
 

 Web.config code:
<add verb="*" path="ct.ashx" type="newtelligence.DasBlog.Web.Services.ClickThroughHandler, newtelligence.DasBlog.Web.Services"/>

 

(2.1) The vulnerability occurs at "ct.ashx?" page, with "&url" parameter,.









(3) Solutions:
2014-10-15 Public disclosure with self-written patch.






References:
https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01235.html

http://marc.info/?l=full-disclosure&m=141378771804426&w=4
http://computerobsess.blogspot.com/2014/12/cve-2014-7292-newtelligence-dasblog.html
http://www.securityfocus.com/bid/70654

http://cxsecurity.com/cveshow/CVE-2014-7292/

http://securitynewswire.com/securitynews2012/article.php?title=CVE20147292_

http://www.venustech.com.cn/NewsInfo/124/30608.Html
http://japanbroad.blogspot.com/2014/11/dasblog-open-redirect-zero-day.html

http://www.scip.ch/en/?vuldb.13185
https://progressive-comp.com/?l=full-disclosure&m=141378771804426&w=1

http://www.tetraph.com/blog/cves/cve-2014-7292

https://packetstormsecurity.com/files/128749/Newtelligence-dasBlog-2.3-Open-Redirect.htmlml

CVE-2014-7290 Atlas Systems Aeon Web Application Service XSS (Cross-Site Scripting) Vulnerability

Exploit Title: Atlas Systems Aeon XSS Vulnerability
Product: Aeon

Vendor: Atlas Systems

Vulnerable Versions: 3.6 3.5

Tested Version: 3.6

Advisory Publication: Nov 12, 2014

Latest Update: February 14, 2015

CVE Reference: CVE-2014-7290

Vulnerability Type: Cross-Site Scripting [CWE-79]
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Solution Status: Fixed by Vendor
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:


(1) Vendor & Product Description:


Vendor:
Atlas



Product & Vulnerable Versions:
Aeon
3.6 3.5



Vendor URL & Download:
Product can be obtained from here,
http://www.atlas-sys.com/aeon/

What is Aeon?
"Aeon is special collections circulation and workflow automation software for your special collections library designed by special collections librarians.

Aeon improves customer service and staff efficiency while providing unparalleled item tracking, security and statistics.

Aeon is request and workflow management software specifically designed for special collections libraries and archives. Aeon improves patron service and maximizes staff efficiency while providing unparalleled item tracking, security and statistics.The Aeon Web Interface enables your patrons to request items directly from your online catalog and finding aids for viewing in your reading room or ordering duplication and digital imaging services, and allows them to monitor fulfillment of their requests through a personalized web account. The Aeon Staff Client permits your staff to manage every step of every transaction, from shelf to patron and back again, with full control and ease. The Aeon Web Reports and custom search features provide quick access to complete patron and item request histories and offer a wide array of usage analyses"

About Atlas:
"Atlas Systems, Inc. is a software development company headquartered in Virginia Beach, VA dedicated to serving libraries. Founded in July 1995 with the mission of “promoting library excellence through efficiency,” Atlas is best known for creating  the ILLiad interlibrary loan management system now exclusively distributed by OCLC and used by more than 1,000 libraries worldwide. Focused on bringing the benefits of automation to library processes that have not been addressed by other software services, Atlas has introduced Ares, an electronic reserves solution, and Aeon, an online request and workflow management system specifically designed for special collections libraries and archives. Atlas takes a process-driven approach to software development. Atlas developers work closely with librarians first to understand the specific user services environment and then to design a system that improves service quality while achieving optimum efficiency and process control. Once the software has been created, Atlas provides implementation, training and ongoing product support, including continual development of new features and enhancements in response to client needs and desires. This workflow review and improvement approach to software design sets Atlas apart in the library automation market."


From:
https://www.atlas-sys.com/products/aeon/downloads/10_112_aeon_broch_web.pdf







(2) Vulnerability Details:
Aeon web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. Aeon has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".

(2.1) The first code flaw occurs at “aeon.dll?” page, with “&Action” parameter.

(2.2) The second code flaw occurs at “aeon.dll?” page, with “&Form” parameter.

(3) Solutions:

2014-09-01: Report vulnerability to Vendor

2014-10-05: Vendor replied with thanks and vendor will change the source code

References:

http://tetraph.com/security/xss-vulnerability/cve-2014-7290
https://progressive-comp.com/?l=full-disclosure&m=141599346408756&w=1

http://germancast.blogspot.com/2015/01/aeon-xss-zero-day-bug.html

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7290

http://www.securityfocus.com/bid/71185

http://computerobsess.blogspot.com/2014/11/cve-2014-7290-atlas-systems-aeon-xss.html
http://www.scap.org.cn/CVE-2014-7290.html
https://cxsecurity.com/issue/WLB-2014110105

https://www.mail-archive.com/fulldisclosure%40seclists.org/msg01309.html
http://marc.info/?l=full-disclosure&m=141599346408756&w=4
https://packetstormsecurity.com/files/129114/Atlas-Systems-Aeon

https://vulnerabilitypost.wordpress.com/2014/12/04/cve-2014-7290