Webmin 1.670 Cross Site Scripting

[kp112]

Webmin version 1.670 suffers from a cross site scripting vulnerability.

. I. VULNERABILITY

-------------------------

Reflected XSS Attacks XSS vulnerabilities in Webmin 1.670

II. BACKGROUND

-------------------------

Webmin is a web-based interface for system administration for Unix.
Using any modern web browser, you can setup user accounts, Apache,
DNS, file sharing and much more. Webmin removes the need to manually
edit Unix configuration files like /etc/passwd, and lets you manage a
system from the console or remotely. See the standard modules page for
a list of all the functions built into Webmin, or check out the
screenshots.




III. DESCRIPTION

-------------------------

Has been detected a Reflected XSS vulnerability in Webmin 1.670 in
page of log, that allows the execution of arbitrary HTML/script code
to be executed in the context of the victim user's browser.
The code injection is done through the parameter "search" in page
https://IP:10000/webminlog/view.cgi?id=1&search=



IV. PROOF OF CONCEPT

-------------------------

https://192.168.49.132:10000/webminlog/view.cgi?id=1&search=e"><script>alert(document.cookie);</script>



V. BUSINESS IMPACT

-------------------------

An attacker can execute arbitrary HTML or script code in a targeted

user's browser, this can leverage to steal sensitive information as
user credentials, personal data, etc.





VI. SYSTEMS AFFECTED

-------------------------



Webmin version 1.670 install in Debian





VII. SOLUTION

-------------------------

All data received by the application and can be modified by the user,

before making any kind of transaction with them must be validated.

VIII. References
-------------------------
http://www.kb.cert.org/vuls/id/381692
http://www.webmin.com/changes.html

Sursa: Webmin 1.670 Cross Site Scripting ? Packet Storm