OpenKM Stored Cross Site Scripting

[Aerosol]

# Exploit Title: OpenKM Platform Remote Reflected Cross Site Scripting
# Google Dork: N/A
# Date: 18-11-2014
# Exploit Author: Mohamed Abdelbaset Elnoby (@SymbianSyMoh)
# Vendor Homepage: http://www.openkm.com/en
<http://s.bl-1.com/h/mQ2bNXq?url=http://www.openkm.com/en>/
# Software Link: http://www.openkm.com/en/download-english.html
<http://s.bl-1.com/h/mQ2bTws?url=http://www.openkm.com/en/download-english.html>
# Version: All versions < 6.4.19 (built 23338)
# Tested on: All OS
# CVE : 2014-9017

-About OpenKM
OpenKM is a Free/Libre document management system that provides a web
interface for managing arbitrary files. OpenKM includes a content
repository, Lucene indexing, and jBPM workflow. The OpenKM system was
developed using Java technology.
In 2005 two developers involved in open source technologies and expertise
with some commercial document management solutions (Sharepoint, Documentum,
Hummingbird, among others) like Excalibur search engine or Kofax OCR engine
decided to start an open source project based on high level technologies to
build a document management system that they decided to call OpenKM.
"-Wikipedia"

-Reference: http://en.wikipedia.org/wiki/OpenKM
<http://s.bl-1.com/h/mQ2bYKv?url=http://en.wikipedia.org/wiki/OpenKM>

-Vulnerability: Remote Reflected/Stored Cross Site Scripting with no remote
interaction
-Severity: Very Critical
-Vulnerable Parameter(s)/Input(s): Tasks
-Info: https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29
<http://s.bl-1.com/h/mQ2cfkx?url=https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29>
-Impact: Remote Admin or Users Full Account Takeover with no interaction.

-Attack Scenario:
1. User#1 "Attacker" : Creates a task with a vulnerable name and assign it
to another User/Admin "Targeted Victim".
2. User#2 "Victim" : Got Exploited with the vulnerable Task made by the
Attacker "User#1" since the Task notification will automatically appears to
the assigned user side "Victim" also the notification popup displays the
vulnerable task name and the victim will be exploited with no interactions.


-PS: This is the most critical attack you will see on OpenKM platform
because it will work remotely against users even with the same scenario
described in the report you can steal/execute a JS in the Administrator's
session.
-PoC Video: http://youtu.be/3jBQFAAq23k

Thanks


-- 
*Best Regards**,**,*


*Mohamed Abdelbaset Elnoby*Guru Programmer, Information Security Evangelist
& Bug Bounty Hunter.
LinkedIn
<http://s.bl-1.com/h/mQ2ck6z?url=https://www.linkedin.com/in/symbiansymoh>Curriculum
Vitae <http://s.bl-1.com/h/mQ2coW1?url=http://goo.gl/cNrVpL>
<http://s.bl-1.com/h/mQ2ctv3?url=https://www.linkedin.com/in/symbiansymoh>
Facebook
<http://s.bl-1.com/h/mQ2cyJ5?url=https://fb.com/symbiansymoh>Twitter
<http://s.bl-1.com/h/mQ2c3j7?url=https://twitter.com/symbiansymoh>

Source