From vul-serv@s21sec.com Fri May 30 18:30:06 2003 From: S21SEC To: bugtraq@securityfocus.com Date: Mon, 26 May 2003 16:13:36 +0200 Subject: S21SEC-023 - Vignette multiple Cross Site Scripting vulnerabilities ############################################################### ID: S21SEC-023-en Title: Multiple Cross Site Scripting vulnerabilities in Vignette Date: 03/04/2003 Status: Vendor contacted and solution available Scope: HTML code Execution in client browsers Platforms: All Author: rpinuaga Location: http://www.s21sec.com/es/avisos/s21sec-023-en.txt Release: External ############################################################### S 2 1 S E C http://www.s21sec.com Multiple Cross Site Scripting vulnerabilities in Vignette About Vignette -------------- Vignette develops Content Management and Application Portal Software. Description of vulnerability ---------------------------- Vignette Software presents multiple Cross Site Scripting vulnerabilities. (XSS) It's possible to inyect HTML code in text variables. This variables when are showed by a Vignette Application, can execute arbitrary code in the client browser. Vignette don't offer any protection against this kind of attacks. For example this way: https://www.somesite.es/Page/1,10966,,00.html?var= Even some default templates are vulnerable to this type of injection: http://www.somestie.es/vgn/login?errInfo="%2b%20document.cookie%20%2b" Vignette does not filter any of the "forbidden" HTML chars (<,>,",&) This vulnerability affects all vignette applications that show input user variables without an explicit filter. Even the default error template is vulnerable. Affected Versions and platforms ------------------------------- This vulnerability has been tested in Vignette StoryServer 4 to Vignette V/6. But it seems that all currently avaliable versions are vulnerable. Solution -------- Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution. Additional information ---------------------- These vulnerabilities have been found and researched by: Ramon Pinuaga Cascales rpinuaga@s21sec.com You can find the last version of this warning in: http://www.s21sec.com/es/avisos/s21sec-023-en.txt And other S21SEC warnings in http://www.s21sec.com/es/avisos/