Bug 89950 – www-apps/phprojekt: Chat Script Insertion Vulnerability

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Jean-François Brunette (RETIRED) 2005-04-21 11:42:12 UTC]

Description:
Secure Science Corporation has reported a vulnerability in PHProjekt, which can be exploited by malicious users to conduct script insertion attacks.

Input passed to the chat in a message is not properly sanitised before being used. This can be exploited to inject arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious user data is viewed via the chat.

The vulnerability has been reported in version 4.2 and prior. Other versions may also be affected.

Solution:
Edit the source code to ensure that input is properly sanitised.

[Comment 1 Thierry Carrez (RETIRED) 2005-04-22 01:34:30 UTC]

Not sure upstream is very alive...

[Comment 2 Aaron Walker (RETIRED) 2005-04-22 05:50:42 UTC]

I see there is a 4.2.3 released 20041227.  I'm assuming it's vulnerable as well looking at the release date.

[Comment 3 Thierry Carrez (RETIRED) 2005-04-28 09:48:02 UTC]

Could someone make sure they know about this ? I tried their bugtracker but it's apparently buggy.

[Comment 4 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-11 07:34:21 UTC]

web-apps any news on this one?

[Comment 5 Matthias Geerdsen (RETIRED) 2005-05-12 13:43:12 UTC]

sent an email upstream

[Comment 6 Matthias Geerdsen (RETIRED) 2005-05-17 06:28:30 UTC]

Summary of the upstream reply:
- basic patch for the chat:
  add this below line 39 in chat/chat.php:
  $content = htmlentities(strip_tags($content));

- PHProjekt has not been particularly checked for XSS issues, since it's
supposed to be an intranet system with only known users.

- Version 5 (coming next month) closes all known XSS issues

[Comment 7 Thierry Carrez (RETIRED) 2005-05-20 10:30:44 UTC]

web-apps: 
I would say patch the (known) vuln and bump... And be sure to migrate to v5
whenever it's available :)

[Comment 8 Thierry Carrez (RETIRED) 2005-05-27 06:38:27 UTC]

web-apps, lease bump

[Comment 9 Aaron Walker (RETIRED) 2005-05-29 13:45:40 UTC]

I have this here ready to commit.  Just have to wait 4-5hrs before the tarball
shows up on the mirrors...  I'll CC ppc once I've committed.

[Comment 10 Aaron Walker (RETIRED) 2005-05-29 22:19:05 UTC]

4.2.3 in cvs, x86 stable. ppc please stable.

[Comment 11 Michael Hanselmann (hansmi) (RETIRED) 2005-05-30 00:14:37 UTC]

Stable on ppc.

[Comment 12 Thierry Carrez (RETIRED) 2005-05-30 00:54:02 UTC]

Ready for GLSA vote

[Comment 13 Sune Kloppenborg Jeppesen (RETIRED) 2005-05-30 08:23:45 UTC]

I tend to vote YES on this one. 

[Comment 14 Jean-François Brunette (RETIRED) 2005-05-31 04:57:44 UTC]

5.0 will not be ready for this month... According to the site:
"Only 55 days until PHProjekt 5 is released. "

[Comment 15 Thierry Carrez (RETIRED) 2005-06-01 06:01:45 UTC]

I think we should wait for phprojekt5 before releasing GLSA : no need to issue
one for half-fixing the XSS issues... so I vote NO.

[Comment 16 Jean-François Brunette (RETIRED) 2005-06-02 07:42:36 UTC]

A little weird but now they talk about 23 days left :)

[Comment 17 Matthias Geerdsen (RETIRED) 2005-06-06 04:57:35 UTC]

I agree with koon, there seem to be more issues. We should probably wait for the
other fixes to do a GLSA.

[Comment 18 Thierry Carrez (RETIRED) 2005-06-06 05:07:25 UTC]

Closing