Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 27 Oct 2015 15:13:51 +0530
From: Dis close <disclose@...ersecurityworks.com>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com
Subject: CVE Request: Cross Site Scripting (XSS) & Cross Site Request Forgery
 (CSRF) in Crony Cronjob Manager Version 0.4.4

Hi,

Details
================
# Title : Cross Site Scripting (XSS) & Cross Site Request Forgery (CSRF) in
Crony Cronjob Manager Version 0.4.4
# Affected Product :  Crony Cronjob Manager Wordpress plugin Version 0.4.4
# Vendor Homepage : https://wordpress.org/plugins/crony/developers/
# Vulnerability Type :  Cross Site Scripting (XSS) & Cross Site Request
Forgery (CSRF)
# Risk :  High
# POC URL               :
https://github.com/cybersecurityworks/Disclosed/issues/9
# Video URL : https://www.youtube.com/watch?v=MY5l91pX-tY
# Status : Fixed

Description
================
By exploiting a Cross-site scripting vulnerability along with Cross Site
Request forgery will gives an easy access to an attacker for hijacking a
logged in user’s session by stealing cookies. This means that the malicious
hacker can change the logged in user’s password and invalidate the session
of the victim while the hacker maintains access.

Technical Details
================

   1. Logon into any wordpress application (attacker)
   2. Click to “Add new cronjob” in Crony Cronjob Manager Version 0.4.4
   Plugin and capture the request in intercepting proxy.
   3. Now, Generate a CSRF Request with attacker logged in account.
   4. Modify the request with the code you required to get executed in
   victim’s browser.
   5. Enter the value for the name variable with *“XSS&CSRF” *and add any
   scripts, malicious code or payload.
   6. Here, its *<script>alert(‘Vulnerable2CSRF&XSS’)</script> *which an
   attacker wants to get executed in victim’s browser and sends the link to
   victim.
   7. Now, once the victim opens the link in the user logged in browser.
   Then, immediately the added XSS payload will be executed whenever we review
   it.


Advisory Timeline
================

2015-08-28 – Discovered in Crony Cronjob Manager Version 0.4.4.
2015-08-28 – Reported to plugins@...dpress.org & lol@...ttkclark.com
2015-08-28 – lol@...ttkclark.com replied, "I'll check it out, thanks for
the heads up."
2015-08-28 – Requested for Advance CVE
2015-09-08 – Another response from developer, "I'll be back into things
tomorrow morning, will let you know once it's up."
2015-09-27 – Issues fixed in version 0.4.6, developer responded.

Fix
================
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Credits & Authors
================
sathish@...ersecurityworks.com from cybersecurityworks Pvt Ltd

About Cybersecurityworks
================
Cybersecurity Works is basically an auditing company passionate working on
findings & reporting security flaws & vulnerabilities on web application
and network. As professionals, we handle each client differently based on
their unique requirements. Visit our website
http://www.cybersecurityworks.com/ for more information.

Please assign CVE as appropriate. Thanks for your valuable time & effort
taken.

--

Cheers !!!

Team CSW

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ