SpagoBI persistent Cross-Site Scripting Vulnerability

Release date:
Updated on:

Affected Systems:
SpagoBI 4.0
Description:
--------------------------------------------------------------------------------
Bugtraq id: 65911
CVE (CAN) ID: CVE-2013-6232

SpagoBI is an open-source business intelligence software package.

SpagoBI 4.0 and other versions are returned to users without verifying certain input. in implementation, there are persistent cross-site scripting attacks. Remote attackers use specially crafted requests, this vulnerability allows you to execute arbitrary script code in your browser.

<* Source: Christian Catalano

Link: http://www.securityfocus.com/archive/1/531322/30/0/threaded
Http://www.exploit-db.com/exploits/32038/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

In execution page can be visible a toolbar with various icons useful
The user to perform actions related to the document runs.
The user can insert a note about the executed document.
The note is associated to the document with relative parameters value
And to the user.
It can be public or private, so public notes are visible to all users
While the private notes are visible only from the user creator.

An attacker (a SpagoBI malicious user with a restricted account) can
Insert a note with jasvascript code:

<Object data = "javascript: alert ('xss')"> </object>

And save it in public mode.
The code execution happens when the victim (an unaware user) click on
Annotate document detail.

This is not the only way to add malicious code in the SpagoBI web app.

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

SpagoBI
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Www.spagworld.org
Http://forge.ow2.org/project/showfiles.php? Group_id = 204