RE: CVE-request: Serendipity 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability

["Secunia Research" <vuln () secunia com>]

Henri,

The GIT commit referenced by the Secunia advisory [1] is the correct fix for
this issue.

The fix removed a line in the code that displayed an unsanitised variable in
one of the template files. This variable was inside a JavaScript comment
block, but this does not prevent exploitation when the payload is prefixed
with a </script> tag.

[1]
https://github.com/s9y/Serendipity/commit/1f037b462761cd592b90541ce4dfda2518
ad4711

--

Med venlig hilsen / Kind Regards,
 
Jon Butler
Junior Security Specialist
  
Secunia
Mikado House
Rued Langgaardsvej 8
2300 Copenhagen S
Denmark 

Phone +45 3338 5726

Please visit our corporate website:
www.secunia.com
   
Follow us on Twitter:
http://twitter.com/secunia


-----Original Message-----
From: Henri Salo [mailto:henri () nerv fi] 
Sent: 1. december 2011 10:59
To: oss-security () lists openwall com
Subject: [oss-security] CVE-request: Serendipity
'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability

Original post: http://seclists.org/bugtraq/2011/Nov/15
Advisory URL: http://www.rul3z.de/advisories/SSCHADV2011-015.txt
New version announcement:
http://blog.s9y.org/archives/233-Serendipity-1.6-released.html

I contacted Garvin Hicking and he said this is indeed fixed in 1.6 code, but
they changed from SVN to Git so can't really refer to proper commit. Secunia
is linking in http://secunia.com/advisories/46666/ to
https://github.com/s9y/Serendipity/commit/1f037b462761cd592b90541ce4dfda2518
ad4711, which has nothing to do with the actual issue. Shame on Secunia.

This is one of logs, which can act like proof:
https://github.com/s9y/Serendipity/commit/db590df6087969e5ef3b07b1b7040e7ec1
22a4fd

Please notify me if this is not enough information.

- Henri Salo