Mailing List Archive: Bugtraq: Bugtraq

New Include Redirect Bug XSS All vBulletin v 3.x.x

Index | Next | Previous | View Threaded

stormhacker at hotmail

Jun 20, 2007, 6:37 AM

Post #1 of 4 (198 views)
Permalink

New Include Redirect Bug XSS All vBulletin v 3.x.x

+--------------------------------------------------------------------
+
+ New Include Redirect Bug XSS All vBulletin® v 3.x.x
+
+--------------------------------------------------------------------
+ vendor site........: http://www.vbulletin.com/
+ Affected Software .: vbulletin
+ Class .............: XSS
+ Risk ..............: Low
+ Found by ..........: rUnViRuS
+ Original advisory .: http://www.sec-area.com/
+ Contact ...........: stormhacker[at]hotmail[.]com
+
+--------------------------------------------------------------------
New Include Redirect Bug XSS All vBulletin v 3.x.x

This injections would allow an attacker to Include Redirect Admin to a page of his choice, effectively
Xss the page and steal cookie :

xss permanent ( must be Upload any File on Site Have Xss code ) PoC :

<script>alert(document.cookie)</script>.

to be used with cookie stealer following is a simple attack :-

http://localhost/vb/admincp/index.php?loc=../../../nez.txt

When opened url Will stealing cookies
+--------------------------------------------------------------------
+ [W]orld [D]efacers [T]eam
+ Greets:
+ || rUnViRuS || - || Provide || - || HeX || - || dEv!L RoOT || + || BlackWHITE || - || dOcnok || - || A.tar0uDant.D ||
+ || Pro Hacker || - || DARKFIRE || - || papipsycho ||
+ Sp.Thanx To : Sec-Area.com Member's
+-------------------------[ W D T ]----------------------------------

scott-REMOVE- at vbulletin

Jun 21, 2007, 8:09 AM

Post #2 of 4 (188 views)
Permalink

Re: New Include Redirect Bug XSS All vBulletin v 3.x.x [In reply to]

There is a much more significant issue than executing an XSS if you can upload a file to a remote site...

If this is how you plan to execute the XSS then there is nothing to fix or even do here on our part.

Scott MacVicar
Development Team, vBulletin

kaneda at bohater

Jun 21, 2007, 11:39 AM

Post #3 of 4 (183 views)
Permalink

Re: New Include Redirect Bug XSS All vBulletin v 3.x.x [In reply to]

On Thu, 21 Jun 2007, scott-REMOVE-[at]vbulletin.com wrote:

:] There is a much more significant issue than executing an XSS if you can upload a file to a remote site...

Good Raining morning...

If he has access for example to /tmp directory or other directory on
hosted server (from another normal (maybe ftp) account in another domain),
he still can run XSS via his bug. In this case his domain can be another
domain (but on the same phisical machine) and IMHO vBulletin should check
path traversal.

best regards
Kanedaaa

btw: of course if he can use ../../ to take file from path outside root
path of vBulletin (like /tmp or another account dir)

:]
:] If this is how you plan to execute the XSS then there is nothing to fix or even do here on our part.
:]
:] Scott MacVicar
:] Development Team, vBulletin
:]

--
[][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]..
[+] You can take our lives,but you will never take our Freedom - W.Wallace
[+] Peace on earth depends on the peace in the peoples hearts - Dalai Lama
[+] Revolution the only solution - System of a down...
[+] Dalej idac dalej dojdziesz dalej siedzac dalej siedzisz - etoe aka ok0
[-] Kanedaaa... Bohateur... Cucumber Team Member... kaneda[at]bohater.net

scott-REMOTE- at vbulletin

Jun 22, 2007, 4:32 AM

Post #4 of 4 (184 views)
Permalink

Re: Re: New Include Redirect Bug XSS All vBulletin v 3.x.x [In reply to]

This isn't a directory traversal, the code is simply output on to the page as <frame src="..."> (sanitised of course), so they can only access what is available in the physical domain.

Scott MacVicar
Development Team, vBulletin

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact lists@gossamer-threads.com