[4.2.x] XSS в календаре

01-31-2014, 09:33 PM

Обнаружена XSS в календаре (calendar.php). Работает на vB 4.2.0 PL1

Code:

To exploit this vulnerability we need (to create/register) account of normal user:

 3.1. Go to Your http://vBullet.in/forum/ and log in as a "normal user". (screen01)
 3.2. After login in, we are redirecting to /activity.php (This page is called 'Activity Stream').
 3.3. Now (as a registered user), we need to go to our /forum/calendar.php.
 3.4. We are now at "HOME-> Calendar ->Default Calendar". Now (on right) we must click 
      to 'Add new event'. (screen02)
 3.5. Vulnerable form here is 'Title'. To check it, type as a title something like:
      test-title'><h1>Hi<br>Noam</h1><script>alert(123);</script> (screen03).
 3.6. And now. Your 'new event' is added 'as a clear text' - by 'clear text' I mean
      'text only, without XSS'. But...
 3.7. Logout now, and log-in again. Your added XSS-code, will be presented at
      first page (activity.php) for user who will log in.

If You want re-test this bug, You should create 2 users: registered1 and registered2.
Add payload ('add new event') as a registered1, and log out. Now log-in as a registered2,
and after login-page, there should be trigerred XSS.

Решение:
Открываем файл /vb/activitystream/view/perm/calendar/event.php

Code:

   public function fetchTemplate($templatename, $activity)
    {
        $eventinfo =& $this->content['event'][$activity['contentid']];
        $calendarinfo =& $this->content['calendar'][$eventinfo['calendarid']];

        $activity['postdate'] = vbdate(vB::$vbulletin->options['dateformat'], $activity['dateline'], true);
        $activity['posttime'] = vbdate(vB::$vbulletin->options['timeformat'], $activity['dateline']);

        $preview = strip_quotes($eventinfo['event']);
        $eventinfo['preview'] = htmlspecialchars_uni(fetch_censored_text(
            fetch_trimmed_title(strip_bbcode($preview, false, true, true, true),
                vb::$vbulletin->options['as_snippet'])
        ));

        $templater = vB_Template::create($templatename);
            $templater->register('userinfo', $this->content['user'][$activity['userid']]);
            $templater->register('activity', $activity);
            $templater->register('eventinfo', $eventinfo);
            $templater->register('calendarinfo', $calendarinfo);
        return $templater->render();
    }

Добавляем следующую строку после $activity[posttime'] :

Code:

$eventinfo['title'] = htmlspecialchars_uni($eventinfo['title']);