Bedita CMS 3.6.0 – Publication Module Bug Report

[cybersecurityworks]

Details

Bedita CMS 3.6.0 – Publication Module Bug Report
Bug Name: XSS (Cross Site Scripting)
Version: 3.6.0
Last Updated: 31/08/2015
Homepage: http://www.bedita.com/
Severity High
Description: XSS vulnerability in Bedita CMS 3.6.0 Publication module

Proof of concept: (POC)

Issue:
POST request URL http://192.168.56.104/bedita/bedita-app/pages/showObjects/2/0/0/leafs of
Bedita CMS 3.6.0 is vulnerable to Cross Site Scripting (XSS)

Figure 1: XSS Payload injected in the given URL http://192.168.56.104/bedita/beditaapp/pages/showObjects/2/0/0/leafs is reflected back in the response

Figure 2: XSS Payload gets executed in the browser

---

Discovered by:
Arjun Basnet from Cyber Security Works Pvt Ltd

[batopa]

Hi @cybersecurityworks here a BEdita dev.
I'm trying to reproduce your POC without success.
I tried to edit the form action via js console and send the form but no alert appears.

I see you used Burp Suite, so I installed it and I'm trying to figure out how to use it to reproduce the attack. I configured Firefox to work with Burp setting Proxy and Burp intercepts every request I do from BEdita. From Burp I edit the POST url of the request intercepted appending "><script>alert(1);</script> and forward the request but nothing happens.

Please could you give me other informations on how to test the attack?
Thanks in advance

[cybersecurityworks]

Hi batopa
Please find the steps below:

Login to the Bedita CMS 3.6.0

Click on Publication tab:

Now open your burp suite and turn on "intercept is on"

Go back to Bedita CMS 3.6.0 application and select "Contents" and click "ADD CONTENTS"

Once you click it will show pop up windows as follows

Go back to your burp suite GUI and you can see request intercepted now right click "send to repeater"

In "Repeater" you can modified the request by appending script(Please refer screenshots) and send request to the server. In Response you can see your payload.

Now right click on your response and send to "Show response in browser"

Copy burp suite response and pasted to your browser as follows

for further queries please feel free to contact us

[batopa]

The fix was committed bedita/bedita@a193208
Soon we'll prepare a new release.
Thanks for your help.

[cybersecurityworks]

Good to know. Then, Is that possible for bedita or bedita development team to give at least credit for discovering this issue? If possible please provide credit to:

"Arjun from Cyber Security Works Pvt Ltd ( http://cybersecurityworks.com)"

This will keep our team motivated to keep on working on enhancing security. Thanks

[batopa]

And finally it's here https://github.com/bedita/bedita/releases/tag/v3.7.0
Sorry for the delay.
Many thanks!