Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 17 Apr 2014 01:25:03 -0400
From: Adam Caudill <adam@...mcaudill.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE Request - XXS in phpMyID (openid_error)


There is a XXS vulnerability in phpMyID v0.9, in the openid_error parameter. The value passed into openid_error is passed through to the output without modification when openid.mode is “error”.

Example:

https://example.com/MyID.config.php?openid.mode=error&openid_error=%3Cscript%3Ealert(1)%3C/script%3E

Here is the code at fault:

MyID.php Line 569:
  function error_mode () {
  	isset($_REQUEST['openid_error']) 
  		? wrap_html($_REQUEST['openid_error'])
  		: error_500();
  }

MyID.php Line 1559:
  function wrap_html ( $message ) {
  	global $charset, $profile;

  	header('Content-Type: text/html; charset=' . $charset);
  	echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
  <html>
  <head>
  <title>phpMyID</title>
  <link rel="openid.server" href="' . $profile['req_url'] . '" />
  <link rel="openid.delegate" href="' . $profile['idp_url'] . '" />
  ' . implode("\n", $profile['opt_headers']) . '
  <meta name="charset" content="' . $charset . '" />
  <meta name="robots" content="noindex,nofollow" />
  </head>
  <body>
  <p>' . $message . '</p>
  </body>
  </html>
  ';

  	exit(0);
  }


Project Page: http://siege.org/phpmyid
Code: https://www.siege.org/oss/phpMyID/trunk/MyID.php

The author has stated that the project is no longer maintained, so hasn’t been notified, and thus there is no fixed version. This is being submitted to raise awareness among those that use this application, and in hopes that a new maintainer will take the project over and address the outstanding issues.

-- 
Adam Caudill
adam@...mcaudill.com
http://adamcaudill.com/



Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ