Mezzanine CMS 4.2.0 Comment Name Persistent cross site scripting

Summaryinfo

A vulnerability was found in Mezzanine CMS 4.2.0. It has been rated as problematic. This affects an unknown function of the component Comment Handler. The manipulation of the argument Name with the input '"><img src=no onerror=alert(1)> leads to cross site scripting (Persistent). Remote exploitation of the attack is possible. Furthermore, an exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Mezzanine CMS 4.2.0 (Content Management System) and classified as problematic. This issue affects an unknown function of the component Comment Handler. The manipulation of the argument name with the input value '"><img src=no onerror=alert(1)> leads to a cross site scripting vulnerability (Persistent). Using CWE to declare the problem leads to CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. Impacted is integrity.

The weakness was published 11/17/2016 by Tim Coen with Curesec Research Team as Mezzanine 4.2.0: XSS as confirmed mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. The public release has been coordinated with Mezzanine. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK. The advisory points out:

When leaving a comment on a blog post, the author name is echoed unencoded in the backend, leading to persistent XSS.

A public exploit has been developed by Tim Coen and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 133 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.2.1 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Similar entry is available at VDB-93696. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Mezzanine

Name

• CMS

Version

• 4.2.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion