osTicket 1.9.12 Cross Site Scripting
Posted on 02 March 2017
------------------------------------------------------------------------ Multiple persistent Cross-Site Scripting vulnerabilities in osTicket ------------------------------------------------------------------------ Han Sahin, July 2016 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ Two persistent Cross-Site Scripting vulnerabilities have been found in osTicket. These issues exists due to the lack of output encoding on user input. These vulnerabilities allow an attacker to inject malicious JavaScript code into the application. This code will then be executed within the browser of a user who views the dashboard. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf. ------------------------------------------------------------------------ Tested versions ------------------------------------------------------------------------ These issues were successfully tested on osTicket version 1.9.12. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ osTicket version 1.9.15 and osTicket version 1.10 are released that address these vulnerabilities. ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://www.securify.nl/advisory/SFY20160801/multiple_persistent_cross_site_scripting_vulnerabilities_in_osticket.html The first issue is located in the file include/staff/header.inc.php and exists due to the fact that the Helpdesk name/title lacks encoding. <head> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta http-equiv="cache-control" content="no-cache" /> <meta http-equiv="pragma" content="no-cache" /> <meta http-equiv="x-pjax-version" content="<?php echo GIT_VERSION; ?>"> <title><?php echo ($ost && ($title=$ost->getPageTitle()))?$title:'osTicket :: '.__('Staff Control Panel'); ?></title> The second vulnerability exists because of the lack of output encoding on the X-Forwarded-For HTTP header. When sending a request with a malicious value in the X-Forwarded-For HTTP header to osTicket, this value will be displayed in the system log dashboard. If script code is added to the X-Forwarded-For HTTP header such code will be injected into the dashboard. include/staff/ticket-view.inc.php: <tr> <th><?php echo __('Source'); ?>:</th> <td><?php echo Format::htmlchars($ticket->getSource()); if (!strcasecmp($ticket->getSource(), 'Web') && $ticket->getIP()) echo ' <span class="faded">('.$ticket->getIP().')</span>'; ?> </td> </tr> include/staff/syslogs.inc.php: <tr id="<?php echo $row['log_id']; ?>"> <td align="center" nowrap> <input type="checkbox" class="ckb" name="ids[]" value="<?php echo $row['log_id']; ?>" <?php echo $sel?'checked="checked"':''; ?>> </td> <td> <a class="tip" href="#log/<?php echo $row['log_id']; ?>"><?php echo Format::htmlchars($row['title']); ?></a></td> <td><?php echo $row['log_type']; ?></td> <td> <?php echo Format::daydatetime($row['created']); ?></td> <td><?php echo $row['ip_address']; ?></td> </tr> These vulnerabilities allow an attacker to inject malicious JavaScript code into the application. This code will then be executed within the browser of a user who views the dashboard. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf.
