Novell GroupWise Web Access Multiple XSS /============================================\ /~ SecureState R&D Team - leroy and sasquatch ~\ /~ Discovered: 11-24-08, 03-05-09 ~\ \~ Vendor Notified: 01-06-09, 03-05-09 ~/ \~ Vendor Publication: 05-21-09 ~/ \============================================/ /------------------------------------------------------------------------------------------------\ /~ Novell's Groupwise WebAccess login page is vulnerable to several cross-site scripting attacks. ~\ /~ ~\ < Example URL: https://www.website.com/gw/webacc > \~ ~/ \~ An attempt to deter the attack is made in that <script> tags are replaced with <!-- pt> ~/ \------------------------------------------------------------------------------------------------/ |--------------------------------------------------------------| | Vulnerable Fields: GWAP.version, User.Theme.index, User.lang | | Vulnerable Versions: 7.0.1, 7.0.3, ? | |--------------------------------------------------------------| | Vulnerable Fields: User.Lang | | Vulnerable Versions: 8.0, ? | |--------------------------------------------------------------| |------------------------------------------------------------------------------| | Phishing via URL Redirection: | | "/><meta http-equiv="refresh" content="0; url=http://www.securestate.com"; /> | |------------------------------------------------------------------------------| | JavaScript Execution Proof of Concept: | | " /><div onmouseover="alert('xss')" style="javascript:visibility:visible;"> | |------------------------------------------------------------------------------| |--------------------------------------------------------------------------------| | Fix Info --> Technical Information Document 7003271 | | | | http://www.novell.com/support/search.do?usemicrosite=true&searchString=7003271 | |--------------------------------------------------------------------------------| | Version 7 --> 7.03 Hot Patch 2 | | Fixes vulnerable fields: GWAP.version, User.Theme, but not User.lang | |--------------------------------------------------------------------------------| | Version 8 (CVE-2009-1635) | |--------------------------------------------------------------------------------|
