Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: Dispute CVE-2012-5903 SMF index.php scheduled-parameter XSS
From: Emanuele <emanuele45 () gmail com>
Date: Mon, 31 Dec 2012 16:21:23 +0100

Hello,

my name is Emanuele, and I'm one of the current SMF developers.

Moritz Naumann wrote:
On 31.12.2012 11:42 Henri Salo wrote:
[..]
  
Until someone provides a working PoC I dispute this issue. SMF hasn't replied to my emails about this.
I'm sorry nobody answered.

Please note there is several comments[1][2] in forums about this too.

    
[..]
  
It's not a security vulnerability if attacker already has administrator access to the application. Should we REJECT 
CVE-2012-5903?
    
Based on the authors' description it would seem more likely that the
attack would use social engineering to trick the legitimate forum admin
into accessing this URL with a payload in it, which would then trigger
in his browser and disclose the admins' session cookie to an attacker by
means of cross site scripting. Like you, I don't see how the value
passed to the "scheduled" parameter would be echoed out, though.
  

As I wrote in my post the scheduled parameter doesn't output anything on
the screen. It is just used to decide what action should be taken.
Relevant code involved:
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/index.php#L81
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/ScheduledTasks.php#L27
https://github.com/SimpleMachines/SMF2.1/blob/release-2.1/Sources/ScheduledTasks.php#L132
These are the only instances of "scheduled" in the entire codebase (the
code is from the future SMF 2.1 version, but it didn't change from 2.0).

Kindred answer (comment [1]) is not relevant. He was probably referring
to another bug we fixed with the latest patch (2.0.3).

1:
http://www.simplemachines.org/community/index.php?topic=491516.msg3445272#msg344527

While it doesn't directly impact treatment of this latest report, I'd
like to point out that there has been a previous report by the same
author on the same product back in october, which I was also unable to
reproduce:

  
[...]
http://packetstormsecurity.com/files/117618/SMF-2.0.2-Cross-Site-Scripting.html
  
And again the "view" is only used to decide the action, but it is not
used to produce any output.

Thank you for the email.

Best regards,
Emanuele


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]