Fork CMS 3.8.3 - XSS Vulnerability

["ITAS Team" <itas.team@xxxxxxx>]

# Exploit Title:	Fork CMS 3.8.3 - XSS Vulnerability
# Vendor:           http://www.fork-cms.com
# Download link:    http://www.fork-cms.com/blog/detail/fork-3.8.4-released
# CVE ID: 			CVE-2014-9470 
# Vulnerability:    Cross-Site Scripting
# Affected version: Fork 3.8.3
# Fixed version:    Fork 3.8.4
# Author:           Le Ngoc Phi - phi.n.le@xxxxxxx & ITAS Team - www.itas.vn

::VULNERABILITY DETAIL::
- Vulnerable parameter:  q_widget
- Vulnerable file:       src/Frontend/Modules/Search/Actions/Index.php
- Vulnerable function:   loadForm()
- Attack vector:
http://forkcms.local/en/search?form=search&q_widget="onmouseover="alert('XSS
')"&submit=Search
- Vulnerable code:
    private function loadForm()
    {
        // create form
        $this->frm = new FrontendForm('search', null, 'get', null, false);

        // could also have been submitted by our widget
        if (!\SpoonFilter::getGetValue('q', null, '')) {
            $_GET['q'] = \SpoonFilter::getGetValue('q_widget', null, '');
        }

        // create elements
        $this->frm->addText(
            'q',
            null,
            255,
            'inputText liveSuggest autoComplete',
            'inputTextError liveSuggest autoComplete'
        );

        // since we know the term just here we should set the canonical url
here
        $canonicalUrl = SITE_URL .
FrontendNavigation::getURLForBlock('Search');
        if (isset($_GET['q']) && $_GET['q'] != '') {
            $canonicalUrl .= '?q=' . $_GET['q'];
        }
        $this->header->setCanonicalUrl($canonicalUrl);
    }

- Fix code: 
private function loadForm()
{
	// create form
	$this->frm = new FrontendForm('search', null, 'get', null, false);
	
	// could also have been submitted by our widget
	if (!\SpoonFilter::getGetValue('q', null, '')) {
		$_GET['q'] = \SpoonFilter::getGetValue('q_widget', null,
'');
	}
	
	// create elements
	$this->frm->addText(
		'q',
		null,
		255,
		'inputText liveSuggest autoComplete',
		'inputTextError liveSuggest autoComplete'
	);
	
	// since we know the term just here we should set the canonical url
here
	$canonicalUrl = SITE_URL .
FrontendNavigation::getURLForBlock('Search');
	if (isset($_GET['q']) && $_GET['q'] != '') {
		$canonicalUrl .= '?q=' .
\SpoonFilter::htmlspecialchars($_GET['q']);
	}
	$this->header->setCanonicalUrl($canonicalUrl);
}

::SOLUTION::
Update to Fork 3.8.4

::TIMELINE::
- 12/25/2014: Detected vulnerability
- 12/25/2014: Inform vendor and the vendor confirmed
- 12/26/2014: Vendor releases patch
- 12/26/2014: ITAS Team publishes information

::REFERENCE::
-
http://www.itas.vn/news/itas-team-found-out-a-cross-site-scripting-vulnerabi
lity-in-fork-cms-70.html
- https://github.com/forkcms/forkcms/issues/1018s
-
https://github.com/forkcms/forkcms/commit/4a7814762adf4f56f932d95146c7e4126d
872114

::COPYRIGHT::
Copyright (c) ITAS CORP 2014, All rights reserved worldwide. Permission is
hereby granted for the electronic redistribution of this information. It is
not to be edited or altered in any way without the express written consent
of ITAS CORP.

::DISCLAIMER::
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY
IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS
A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION
OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS,
AND AT THE USER'S OWN RISK.



Best Regards,
----------------------------------------------------------------------------
----------------
ITAS Team

ITAS Corp.   Be protected with us 
Office     : 24 Dang Thai Mai St., Ward 7, Phu Nhuan District, HCMC.
Tel         : +84 - 8 - 38931952                               Hotline : 
0903445711
Email     :  info@xxxxxxx                              www.itas.vn