Research

Novell Vibe OnPrem 3 BETA Stored Cross-site Scripting Vulnerability

Solutionary ID: SERT-VDN-1002

CVE ID: CVE-2010-4322

Product: Novell Vibe OnPrem 3 BETA Stored Cross-site Scripting Vulnerability

Application Vendor: Novell

Vendor URL: http://www.novell.com/products/vibe-onprem/

Date discovered: 11/10/2010

Discovered by: Rob Kraus, Paul Petefish, and Solutionary Engineering Research Team (SERT)

Vendor notification date: 12/3/2010

Vendor response date: 12/3/2010

Vendor acknowledgment date: 12/3/2010

Public disclosure date: 12/10/2010

Type of vulnerability: Stored Cross-site Scripting (XSS)

Exploit Vectors: Local and Remote

Vulnerability Description: Users can include and store arbitrary client side code such as JavaScript in the Novell Vibe Web application. The code then can be executed within an unsuspecting victim’s browser. The vulnerability exists due to the “/gwtTeaming.rpc” code not properly sanitizing user input into the “What Are You Working On?” or Micro Blog entry field. Also, the application fails to encode the output allowing for the execution of the script.

Tested on: Cent OS 5.5 (kernel 2.6.18-194), MySQL Version 14.12 Distribution 5.0.77, and Novell Vibe 3 BETA OnPrem.

Affected software versions: Vibe 3 BETA OnPrem

Impact: Any user who can view another user’s Micro Blog entry is vulnerable to this XSS attack. Successful exploitation of this vulnerability could result in session cookie theft, session hijacking, URL redirection, and possible operating system code execution on the targeted victim’s host.

Fixed in: Fixed in the final shipping version of Novell Vibe OnPrem 3

Remediation guidelines: Update to the final shipping version of Novell Vibe OnPrem 3

Risk Level: 7.0

(CVSS version 2)

High Risk