-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stored Cross Site Scripting in Ektron CMS 8.7

CVE reference: CVE-2014-2729
Affected platforms: Ektron Web Content Management System
Version: 8.7.0
Date: 2013-December-19
Security risk: Medium (CVSS - AV:N/AC:L/Au:S/C:P/I:P/A:N)
Researcher: Joseph Zeng Xianbo
Vendor Status: Issue reported to be patched in Ektron CMS 8.7.0.055
SP2 Patch Update: 8.7.0.055.2.015).

=====================================================================
Description:

During an internal penetration test exercise for a client, a stored
Cross Site Scripting vulnerability was discovered in the HTTP parameter
‘category0’ of the affected webpage. The application stored the payload
and executed the payload when the page was loaded.

This vulnerability has been assigned CVE-2014-2729.

=====================================================================
Steps to demonstrate issue:

1. Login to the CMS Workarea
2. Click on the Content tab
3. On the Folders subpanel, right click on an existing folder. Click
   the 'Add Discussion Board' button
4. On the Properties tab, complete all mandatory fields
5. Click on the Templates tab and select a template on the Templates
   page
6. Click on the Subjects tab
7. Click the 'Add Subject' button
8. Fill in the Subject field with the text 'testing text'
9. Click the 'Add Discussion Board' button
10. Use a proxy tool such as Burp Suite Professional. Allow the HTTP
    GET request to AJAXbase.aspx to be sent unmodified to the server.
11. Intercept the HTTP POST request to content.aspx with Burp proxy
    tool
12. Modify the value of the HTTP parameter 'category0' to
    'testing+text<iframe src="http://example.com"></iframe>'
13. Send the modified HTTP POST request
14. On the Folder subpanel, right click on the newly created
    discussion board
15. Click “View Properties” from the menu which appears
16. Click on the Subjects tab
17. You should observe that the malicious JavaScript code is
    successfully executed

Note that repeating steps 7 to 8 and repeating the step 12 for the
corresponding parameters (e.g. 'category1', 'category2')

=====================================================================
Possible Impact

Malicious authenticated users could inject specially crafted
JavaScript code into multiple input fields of the affected form
(Add Discussion Board) which gets stored. When an administrative user
subsequently retrieves and views the records from the administrative
interface, the injected malicious JavaScript code will be executed
in his/her web browsers.

=====================================================================
Credits

This vulnerability was discovered by Joseph Zeng Xianbo

=====================================================================
History (GMT +8)

14 Aug 2013 - Vulnerability discovered and reported to client. Client reports it to System Integrator and Ektron.
6 Dec 2013 - Test on Ektron CMS 8.70 SP 2 shows vulnerability is still present
10 Mar 2014 - Test on patched Ektron CMS shows vulnerability has been resolved
26 Mar 2014 - Secunia informed of vulnerability
3 Apr 2014 - Secunia declines to issue advisory as Ektron CMS version 9 supersedes patched version. Case referred to MITRE.
5 Apr 2014 - CVE identifier assigned for this vulnerability
7 Apr 2014 - Ektron contacted for patch details
8 Apr 2014 - Ektron asks System Integrator for patch details
10 Apr 2014 - System Integrator gives notification of patch details
16 Apr 2014 - Advisory Released.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQEcBAEBAgAGBQJTTokOAAoJEC7dR+igIW6kRf0H/34IM2qxQraoAXlHe0PjAqA+
3dkgrDQxNy0cpnYJ6yFTq4j55UdYBQHRDUCAxZTztCVwUpDKUC+CrYAFYTdBQrDh
4fQUL0BLDTsD6SOO61mY0M+/ZEywrLNzB7kYc4P9Er4BCVFQwJ00teCD5NP8L6dZ
Upzux8rdO7MlBsngfSOGxjzfdxNNwZJyGet5b4zej7uniwE5EHlyFVEpLgOd0Sua
9qEg7Y8V/IHoWiRX2yapvliQDmoSi9qLHxuPNiAFkHJ6qqR7UvwnuxdLlzsFCvQn
EHC7MVk2wcyPEjzTLCDxmt6U9qHju8kqRA2SZYQPEGsl3McfZLyrvXN8lZHCV+I=
=iInp
-----END PGP SIGNATURE-----