S21SEC-023 - Vignette multiple Cross Site Scripting vulnerabilities

[S21SEC <vul-serv () s21sec com>]

###############################################################
ID: S21SEC-023-en
Title: Multiple Cross Site Scripting vulnerabilities in Vignette
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: HTML code Execution in client browsers
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-023-en.txt
Release: External
###############################################################

                                S 2 1 S E C

                           http://www.s21sec.com

            Multiple Cross Site Scripting vulnerabilities in Vignette


About Vignette
--------------

Vignette develops Content Management and Application Portal Software.


Description of vulnerability
----------------------------

Vignette Software presents multiple Cross Site Scripting vulnerabilities. (XSS)

It's possible to inyect HTML code in text variables. This variables when are showed by a Vignette Application, can 
execute arbitrary code in the client browser.

Vignette don't offer any protection against this kind of attacks. 

For example this way:

https://www.somesite.es/Page/1,10966,,00.html?var=<script>alert('s21sec')</script>


Even some default templates are vulnerable to this type of injection:

http://www.somestie.es/vgn/login?errInfo="%2b%20document.cookie%20%2b";


Vignette does not filter any of the "forbidden" HTML chars (<,>,",&)

This vulnerability affects all vignette applications that show input user variables without an explicit filter. Even 
the default error template is vulnerable.


Affected Versions and platforms
-------------------------------

This vulnerability has been tested in Vignette StoryServer 4 to Vignette V/6. But it seems that all currently avaliable 
versions are vulnerable.


Solution
--------

Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.



Additional information
----------------------

These vulnerabilities have been found and researched by:

 Ramon Pinuaga Cascales         rpinuaga () s21sec com

You can find the last version of this warning in:

        http://www.s21sec.com/es/avisos/s21sec-023-en.txt

And other S21SEC warnings in http://www.s21sec.com/es/avisos/