Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 27 Feb 2012 22:09:38 +0100
From: RafaƂ Malinowski <>
To: Kurt Seifried <>
Cc:, Mateusz Goik <>, 
	"Steven M. Christey" <>, Mariusz Fik <>, 
	Radoslaw Lisowski <>,
Subject: Re: Re: CVE Status Clarification / Request -- kadu:
 Stored XSS by parsing contact's status and sms messages in history

Affected versions: 0.9.0 - 0.11.0 (0.11.1 is not vulnerable)


Any javascript code could be executed from Kadu History Window in
following conditions:
* application owner send a prepared SMS and content of this SMS was
stored in history file
* owner of application has an attacker on his buddy list, attacker
sets a prepared presence message/status description and this presence
message/status description is stored in history file

and then:

* owner of application views given SMS or presence message/status
description in history window

Javascript code was allowed to:
* load any file from WEB, by <img> or <script> tags, even <object>
with flash files were possible
* read files from local file system
* (not confirmed by myself) write files to local file system
* show javascript windows (like alert)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.