Bug 336319 (CVE-2010-3077)

Summary:	<www-apps/horde-3.3.9: Cross Site Scripting Vulnerability (CVE-2010-3077)
Product:	Gentoo Security	Reporter:	Tim Sammut (RETIRED) <underling>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	a3li
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.horde.org/diff.php/horde/util/icon_browser.php?rt=horde-git&r1=a978a35c3e95e784253508fd4333d2fbb64830b6&r2=9342addbd2b95f184f230773daa4faf5ef6d65e9
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---

Description Tim Sammut (RETIRED) gentoo-dev

2010-09-07 03:00:45 UTC

The upstream change is at $url.

From http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0084.html

<--

Horde Application Framework v3.3.8 and lower are subject to a cross site
scripting (XSS) vulnerability.

The icon_browser.php script fails to properly sanitize user supplied
input to the 'subdir' URL parameter before printing it out as part of a
HTML formatted error message.

The following URL can be used as a proof of concept:

> [path_to_horde]/util/icon_browser.php?subdir=<body onload="alert('XSS')">&app=horde

Prior authentication is not required for exploitation.

This vulnerability was reported to the Horde Project on 19.05.2010 and
fixed by Michael M. Slusarz in the frameworks' GIT repository within a week:
> http://git.horde.org/diff.php/horde/util/icon_browser.php?rt=horde-git&r1=a978a35c3e95e784253508fd4333d2fbb64830b6&r2=9342addbd2b95f184f230773daa4faf5ef6d65e9

Hoping to see an upcoming fixed release (which did not take place)
I have delayed publication - admittedly too much.

Credits for this discovery:

Moritz Naumann
Naumann IT Security Consulting, Berlin, Germany
http://moritz-naumann.com

Comment 1 Alex Legler (RETIRED) archtester

2010-09-29 16:34:33 UTC

Fixed in 3.3.9 as per http://lists.horde.org/archives/announce/2010/000557.html.

Comment 2 Alex Legler (RETIRED) archtester

2010-09-29 18:40:39 UTC

Arches, please test and mark stable:
=www-apps/horde-3.3.9
Target keywords : "alpha amd64 hppa ppc sparc x86"

Comment 3 Andreas Schürch gentoo-dev

2010-10-01 11:08:49 UTC

I tested the following things together on x86 with apache (dev-lang/php-5.2.14) and my dovecot imap server. I've seen no problems at all! :-)

www-apps/horde-3.3.9 Bug #336319
www-apps/horde-imp-4.3.8 Bug #307759
www-apps/horde-dimp-1.1.5 Bug #307759
www-apps/horde-gollem-1.1.2 Bug #339168

Comment 4 Tobias Klausmann (RETIRED) gentoo-dev

2010-10-02 14:59:22 UTC

Stable on alpha.

Comment 5 Markos Chandras (RETIRED) gentoo-dev

2010-10-03 16:40:29 UTC

amd64 done

Comment 6 Markus Meier gentoo-dev

2010-10-05 19:12:35 UTC

x86 stable, thanks Andreas

Comment 7 Brent Baude (RETIRED) gentoo-dev

2010-10-08 19:35:28 UTC

ppc done

Comment 8 Raúl Porcel (RETIRED) gentoo-dev

2010-10-10 17:01:59 UTC

sparc stable

Comment 9 Jeroen Roovers (RETIRED) gentoo-dev

2010-10-19 02:17:00 UTC

Stable for HPPA.

Comment 10 Tim Sammut (RETIRED) gentoo-dev

2010-10-19 02:21:04 UTC

Thanks, folks.

GLSA Vote: No, XSS.

Comment 11 Stefan Behte (RETIRED) gentoo-dev

2010-11-21 17:01:45 UTC

XSS in webapp -> closing noglsa.