New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 801178 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: viewvc-1.1.22 xss exploit

Reported by arnoldki...@gmail.com, Jan 11 2018

Issue description

Host: src.chromium.org
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0
software:viewvc-1.1.22

1.DESCRIPTION OF VULNURABILITY:

Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name.

2.STEP TO REPRODUCE:
 a-open https://src.chromium.org/viewvc
 b-inspect element and go to network
 c-substitued methode GET to POST to look into server side
 d-view reponse of server:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<!-- ViewVC :: http://www.viewvc.org/ -->
<head>
<title>ViewVC Exception</title>
</head>
<body>
<h3>An Exception Has Occurred</h3>



<h4>Python Traceback</h4>
<p><pre>
Traceback (most recent call last):
  File &quot;/usr/lib/viewvc/lib/viewvc.py&quot;, line 4844, in main
    request.run_viewvc()
  File &quot;/usr/lib/viewvc/lib/viewvc.py&quot;, line 149, in run_viewvc
    for name, values in self.server.params().items():
  File &quot;/usr/lib/viewvc/lib/sapi.py&quot;, line 184, in params
    return cgi.parse()
  File &quot;/usr/lib/python2.7/cgi.py&quot;, line 149, in parse
    ctype, pdict = parse_header(environ['CONTENT_TYPE'])
  File &quot;/usr/lib/python2.7/UserDict.py&quot;, line 40, in __getitem__
    raise KeyError(key)
KeyError: 'CONTENT_TYPE'

</pre></p>


</body>
</html>
  Escape some raw path data before handing off to templates
* lib/viewvc.py
  (nav_path): Escape the 'name' property of navigation path components
    the same way we escape that of the 'root' path component.
item = _item(name=part, href=None)  to item = _item(name=request.server.escape(part), href=None)









 
Screenshot from 2018-01-11 14-30-39.png
150 KB View Download
Screenshot from 2018-01-11 15-18-43.png
153 KB View Download
Components: Infra>Client>Chrome
Do you have a POST body that reproduces script execution in the target domain?
why i approve that version of viewvc-1.1.22 vulnerable and i'am  no responsbale for give you how the exploitation make 

Comment 3 Deleted

Comment 4 Deleted

Status: Available (was: Unconfirmed)
This is CVE-2017-5938, referenced here: https://github.com/viewvc/viewvc/blob/master/CHANGES

We should make sure src.chromium.org is running the latest ViewVC, if it's not already.
Cc: dpranke@chromium.org
Labels: Security_Severity-High
Owner: aga...@chromium.org
agable -- Can you assign an appropriate owner, if not you? Thanks.

Comment 7 by aga...@chromium.org, Jan 18 2018

Cc: aga...@chromium.org
Components: -Infra>Client>Chrome Infra>Labs
Labels: Pri-0
Owner: vhang@chromium.org
We are currently running viewvc 1.1.22, several versions out of date.

vhang: please find an appropriate member of the labs team to update the installation of viewvc to 1.1.26 on the svn.golo host.

Comment 8 by vhang@chromium.org, Jan 18 2018

Cc: b...@chromium.org friedman@chromium.org pboggini@chromium.org d...@chromium.org jo...@chromium.org pschmidt@chromium.org
Owner: friedman@chromium.org
Status: Assigned (was: Available)
Please take a look and let me know if everything looks hunky-dory.

https://src.chromium.org/viewvc
Install notes:
1) download new tarball, tar zxf
2) cd $new_dir; ./viewvc-install
3) point it to /usr/lib/viewvc-$version (/usr/lib/viewvc-1.1.26)
4) cd /usr/lib/viewvc-$version
5) mkdir cgi-bin
6) for i in bin/cgi/viewvc.cgi bin/wsgi/viewvc.{fcgi,wsgi}; do cp $i cgi-bin/; done
7) mv viewvc.conf viewvc.conf_install
8) cp /etc/viewvc.conf .
9) cd /usr/lib
10) ln -sfvT viewvc-$version viewvc

Done.
Status: Fixed (was: Assigned)
Labels: reward-NA
why i dont reward for this bug ???

Comment 14 Deleted

Project Member

Comment 15 by sheriffbot@chromium.org, Feb 8 2018

Labels: -Restrict-View-SecurityTeam Restrict-View-SecurityNotify
Project Member

Comment 16 by sheriffbot@chromium.org, Apr 27 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 17 by sheriffbot@chromium.org, Jul 28

Labels: -Pri-0 Pri-1

Sign in to add a comment