Mahara up to 16.10.6/17.04.4/17.10.1 param_exists Unicode Character cross site scripting

Summaryinfo

A vulnerability labeled as problematic has been found in Mahara up to 16.10.6/17.04.4/17.10.1. Affected by this issue is the function param_exists. Executing a manipulation as part of Unicode Character can lead to cross site scripting. This vulnerability is registered as CVE-2017-17454. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Mahara up to 16.10.6/17.04.4/17.10.1 (Content Management System) and classified as problematic. This vulnerability affects the function param_exists. The manipulation as part of a Unicode Character leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value.

The bug was discovered 11/17/2017. The weakness was published 02/20/2018 (Website). The advisory is shared for download at mahara.org. This vulnerability was named CVE-2017-17454 since 12/06/2017. The attack can be initiated remotely. A single authentication is necessary for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

The vulnerability was handled as a non-public zero-day exploit for at least 95 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 16.10.7, 17.04.5 or 17.10.2 eliminates this vulnerability.

Similar entry is available at VDB-113621. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• Mahara

Version

• 16.10.0
• 16.10.1
• 16.10.2
• 16.10.3
• 16.10.4
• 16.10.5
• 16.10.6
• 17.04.0
• 17.04.1
• 17.04.2
• 17.04.3
• 17.04.4
• 17.10.0
• 17.10.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion