############################################################### ID: S21SEC-023-en Title: Multiple Cross Site Scripting vulnerabilities in Vignette Date: 03/04/2003 Status: Vendor contacted and solution available Scope: HTML code Execution in client browsers Platforms: All Author: rpinuaga Location: http://www.s21sec.com/es/avisos/s21sec-023-en.txt Release: External ############################################################### S 2 1 S E C http://www.s21sec.com Multiple Cross Site Scripting vulnerabilities in Vignette About Vignette -------------- Vignette develops Content Management and Application Portal Software. Description of vulnerability ---------------------------- Vignette Software presents multiple Cross Site Scripting vulnerabilities. (XSS) It's possible to inyect HTML code in text variables. This variables when are showed by a Vignette Application, can execute arbitrary code in the client browser. Vignette don't offer any protection against this kind of attacks. For example this way: https://www.somesite.es/Page/1,10966,,00.html?var=<script>alert('s21sec')</script> Even some default templates are vulnerable to this type of injection: http://www.somestie.es/vgn/login?errInfo="%2b%20document.cookie%20%2b" Vignette does not filter any of the "forbidden" HTML chars (<,>,",&) This vulnerability affects all vignette applications that show input user variables without an explicit filter. Even the default error template is vulnerable. Affected Versions and platforms ------------------------------- This vulnerability has been tested in Vignette StoryServer 4 to Vignette V/6. But it seems that all currently avaliable versions are vulnerable. Solution -------- Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution. Additional information ---------------------- These vulnerabilities have been found and researched by: Ramon Pinuaga Cascales rpinuaga@s21sec.com You can find the last version of this warning in: http://www.s21sec.com/es/avisos/s21sec-023-en.txt And other S21SEC warnings in http://www.s21sec.com/es/avisos/