Gazelle – Multiple Cross-Site Scripting (XSS) in “ocelot_info.php”

bestshow commented 7 years ago

Product: Gazelle Download: https://github.com/WhatCD/Gazelle Vunlerable Version: latest version Tested Version: latest version Author: ADLab of Venustech

Advisory Details: Multiple Cross-Site Scripting (XSS) were discovered in “Gazelle latest version”, which can be exploited to execute arbitrary code. The vulnerabilities exist due to insufficient filtration of user-supplied data in multiple HTTP GET parameters passed to the “Gazelle-master/sections/tools/data/ocelot_info.php” URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website. The exploitation examples below use the "alert()" JavaScript function to see a pop-up messagebox: Poc: (1) http://localhost/.../Gazelle-master/sections/tools/data/ocelot_info.php?action=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22 (2) http://localhost/.../Gazelle-master/sections/tools/data/ocelot_info.php?userid=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22

scriptzteam commented 7 years ago

:)

https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS

bestshow commented 7 years ago

Thanks. You mean you have developed this tool to solve these issues which I reported ?

scriptzteam commented 7 years ago

Yep, always around here to help ;) It need custom tweaks as it can strip out or replace some titles (torrent names) but thats just basic edit ...

kvantor commented 7 years ago

I will follow yours patch too ;-)

lattedesu commented 7 years ago

@scriptzteam what if the get/post value is an array ? in your fix (which should be a pull request definitely) I believe you're assuming all given $values are string. Also, does that preg_replace passes non-latin-yet-alphabethic characters?

E.g: what happens when I post something like:

key1 => value1
key2 => [
subkey1 = bad_xss_code
subkey2 = value2
subkey3 = worse_xss_code
]

?

WhatCD / Gazelle

Gazelle – Multiple Cross-Site Scripting (XSS) in “ocelot_info.php” #112