Multiple Services such as VHS(Video History Server) and VCD(Video Clip Distributor) and Clips2 were discovered to be vulnerable to an unauthenticated arbitrary file read/write vulnerability due to missing input validation on filenames. A malicious attacker could read sensitive files from the filesystem or write/delete arbitrary files on the filesystem as well.

CVE-2023-30945: Palantir | Trust and Security Portal

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32531 through 32535.

May 24th, 2023

**Trend Micro Apex Central Cross-Site Scripting Remote Code Execution Vulnerability****ZDI-23-725  
ZDI-CAN-18874**

CVE ID

CVE-2023-32534

CVSS SCORE

6.1, (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

AFFECTED VENDORS

Trend Micro  

AFFECTED PRODUCTS

Apex Central  

VULNERABILITY DETAILS

This vulnerability allows

ADDITIONAL DETAILS

Trend Micro has issued an update to correct this vulnerability. More details can be found at:  
https://success.trendmicro.com/solution/000293107  

DISCLOSURE TIMELINE

*   2022-12-29 - Vulnerability reported to vendor
*   2023-05-24 - Coordinated public release of advisory

CREDIT

Poh Jia Hao of STAR Labs  

BACK TO ADVISORIES

CVE-2023-32534: ZDI-23-725

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32532 through 32535.

May 24th, 2023

**Trend Micro Apex Central Cross-Site Scripting Remote Code Execution Vulnerability****ZDI-23-724  
ZDI-CAN-18872**

CVE ID

CVE-2023-32531

CVSS SCORE

6.1, (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

AFFECTED VENDORS

Trend Micro  

AFFECTED PRODUCTS

Apex Central  

VULNERABILITY DETAILS

This vulnerability allows

ADDITIONAL DETAILS

Trend Micro has issued an update to correct this vulnerability. More details can be found at:  
https://success.trendmicro.com/solution/000293107  

DISCLOSURE TIMELINE

*   2022-12-29 - Vulnerability reported to vendor
*   2023-05-24 - Coordinated public release of advisory

CREDIT

Poh Jia Hao of STAR Labs  

BACK TO ADVISORIES

CVE-2023-32531: ZDI-23-724

Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers.

This is similar to, but not identical to CVE-2023-32531 through 32534.

May 24th, 2023

**Trend Micro Apex Central Cross-Site Scripting Remote Code Execution Vulnerability****ZDI-23-857  
ZDI-CAN-18867**

CVE ID

CVE-2023-32535

CVSS SCORE

6.1, (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

AFFECTED VENDORS

Trend Micro  

AFFECTED PRODUCTS

Apex Central  

VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trend Micro Apex Central. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of the serverid parameter provided to the index.php component. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of arbitrary script. An attacker can leverage this vulnerability to execute script in the context of the current user.  

ADDITIONAL DETAILS

Trend Micro has issued an update to correct this vulnerability. More details can be found at:  
https://success.trendmicro.com/solution/000293107  

DISCLOSURE TIMELINE

*   2022-12-29 - Vulnerability reported to vendor
*   2023-05-24 - Coordinated public release of advisory
*   2023-06-14 - Advisory Updated

CREDIT

Poh Jia Hao of STAR Labs  

BACK TO ADVISORIES

CVE-2023-32535: ZDI-23-857

Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of crafted html file.

CVE-2023-27082

Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbitrary code via the video-js.swf.

Publication date:

**21/04/2020, 14:50**

  
Severity:**

High

**  
Affected versions: **DemoBundle and ezdemo extension, all versions**  
Resolving versions: **DemoBundle v5.4.6.1, ezdemo v5.4.2.1, ezdemo-ls-extension v5.4.2.1**

This Security Advisory is about a vulnerability in VideoJS, which is bundled in DemoBundle and the ezdemo legacy extension. Older releases of VideoJS contain an XSS vulnerability in the Flash-based video player. This is bundled in DemoBundle, and in the Legacy "ezdemo" and "ezdemo-ls-extension" extensions. Among the branches still receiving security advisories, only eZ Publish Platform 5.4 and eZ Publish Legacy 5.4 are affected. However, it may be possible to make this software work in newer branches, so please check whether you have it installed even if you're using eZ Platform 1.x or 2.x.

Because DemoBundle / ezdemo are only intended for demo purposes, they are not supported software. For that reason, and given the old age of the software, and manpower issues during the Coronavirus crisis, we are taking the unusual step of simply removing the affected file. This resolves the vulnerability, but also breaks the video playback feature. It may be possible to make it work again by upgrading to a current version of VideoJS, but it is unlikely that we will do this, given the reasons already mentioned.

This security update is distributed via Composer, see "Resolving versions" above. Please verify that after the update you do not have the file "video-js.swf" in any directory accessible by your web server.

The issue was reported to us by Purplemet. Purplemet is a security monitoring and rating SaaS solution for web applications. We are very grateful for their research, and responsible disclosure to us.

https://www.purplemet.com/

CVE-2020-23065: XSS in DemoBundle/ezdemo bundled VideoJS

Cross Site Scripting vulnerability in jQuery v.2.2.0 thru v.3.5.0 allows a remote attacker to execute arbitrary code via the <options> element.

jQuery 3.5.0 has been released! As usual, the release is available on our cdn and the npm package manager. Other third party CDNs will probably have it soon as well, but remember that we don’t control their release schedules and they will need some time.

We hope you’re staying healthy and safe while so many of us are stuck at home. With a virus ravaging the planet, we realize that jQuery may not be a high priority for you or the sites you manage. When you do have a moment, we recommend that you review this new version and upgrade.

**Security Fix**

The main change in this release is a security fix, and it’s possible you will need to change your own code to adapt. Here’s why: jQuery used a regex in its jQuery.htmlPrefilter method to ensure that all closing tags were XHTML-compliant when passed to methods. For example, this prefilter ensured that a call like jQuery("<div class='hot' />") is actually converted to jQuery("<div class='hot'></div>"). Recently, an issue was reported that demonstrated the regex could introduce a cross-site scripting (XSS) vulnerability.

The HTML parser in jQuery <=3.4.1 usually did the right thing, but there were edge cases where parsing would have unintended consequences. The jQuery team agreed it was necessary to fix this in a minor release, even though some code relies on the previous behavior and may break. The jQuery.htmlPrefilter function does not use a regex in 3.5.0 and passes the string through unchanged.

If you absolutely need the old behavior, using the latest version of the jQuery migrate plugin provides a function to restore the old jQuery.htmlPrefilter. After including the plugin you can call jQuery.UNSAFE_restoreLegacyHtmlPrefilter() and jQuery will again ensure XHTML-compliant closing tags.

However, to sanitize user input properly, we also recommend using dompurify with the SAFE_FOR_JQUERY option to sanitize HTML from a user. If you don’t need the old behavior, but would still like to sanitize HTML from a user, dompurify should be used **without** the SAFE_FOR_JQUERY option, starting in jQuery 3.5.0. For more details, please see the 3.5 Upgrade Guide.

**Features**

With what we call “positional selectors” being deprecated and slated for removal in jQuery 4.0, we’ve added the last two necessary replacement methods. Specifically, we’ve added the .even() and .odd() methods to replace the :even and :odd selectors. With these methods in place, we can safely remove these overly complicated selectors in jQuery 4.0.

Another small feature that we’ve added to this release is the ability to add a context to jQuery.globalEval. This was done as part of fixing a bug with script execution in iframes.

**Fixes**

One bug worth highlighting is a bug we fixed in the Ajax script transport. jQuery used to evaluate any response to a request for a script as a script, which is not always the desired behavior. This is different than other data types where such a convention was fine (e.g. in the case of JSON). jQuery 3.5.0 will now only evaluate successful HTTP responses.

Other bug fixes and improvements include performance improvements in Sizzle, support for massive arrays in jQuery.map, using the native .flat() method where supported, a fix for syntax errors in the AMD modules, several improvements to our testing infrastructure, and more. You’ll find the full changelog below.

**Deprecations**

It wouldn’t be a jQuery release without some deprecations. In jQuery 3.5.0, we’ve put jQuery.trim on the list. JavaScript’s own String.prototype.trim() is an easy replacement for it.

We’ve also put AJAX event aliases on the list, they can be replaced by .on("ajaxStart", …) and the like. jQuery Migrate will warn about these now-deprecated methods, but they’ll stick around until jQuery 4.0.

**Upgrading**

Aside from the change to no longer ensure XHTML-compliant tags for you, we do not expect other compatibility issues when upgrading from a jQuery 3.0+ version. To upgrade, have a look at the new 3.5 Upgrade Guide. If you haven’t yet upgraded to jQuery 3+, first have a look at the 3.0 Upgrade Guide.

The jQuery Migrate plugin will help you to identify compatibility issues in your code. Please try out this new release and let us know about any issues you experienced.

If you can’t yet upgrade to 3.5+, Daniel Ruf has kindly provided patches for previous jQuery versions.

**Download**

You can get the files from the jQuery CDN, or link to them directly:

https://code.jquery.com/jquery-3.5.0.js

https://code.jquery.com/jquery-3.5.0.min.js

You can also get this release from npm:

npm install jquery@3.5.0

**Slim build**

Sometimes you don’t need ajax, or you prefer to use one of the many standalone libraries that focus on ajax requests. And often it is simpler to use a combination of CSS and class manipulation for web animations. Along with the regular version of jQuery that includes the ajax and effects modules, we’ve released a “slim” version that excludes these modules. The size of jQuery is very rarely a load performance concern these days, but the slim build is about 6k gzipped bytes smaller than the regular version. These files are also available in the npm package and on the CDN:

https://code.jquery.com/jquery-3.5.0.slim.js

https://code.jquery.com/jquery-3.5.0.slim.min.js

These updates are already available as the current versions on npm and Bower. Information on all the ways to get jQuery is available at https://jquery.com/download/. Public CDNs receive their copies today, please give them a few days to post the files. If you’re anxious to get a quick start, use the files on our CDN until they have a chance to update.

**Thanks**

Thank you to all of you who participated in this release by submitting patches, reporting bugs, or testing, including Ahmed S. El-Afifi, Michal Golebiowski-Owczarek, Wonseop Kim, Dave Methvin, Shashanka Nataraj, Pat O’Callaghan, Sean Robinson, Christian Oliff, Christian Wenz, and the whole jQuery team.

We also would like to thank Masato Kinugawa for helping us identify and fix the security-related issues in this release.

**Changelog**

**Full changelog:** 3.5.0

CVE-2020-23064: jQuery 3.5.0 Released! | Official jQuery Blog

Cross Site Scripting vulnerability in TinyMCE v.4.9.6 and before and v.5.0.0 thru v.5.1.4 allows an attacker to execute arbitrary code via the editor function.

**Impact**

A cross-site scripting (XSS) vulnerability was discovered in: the core parser, paste and visualchars plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.6 or lower and TinyMCE 5.1.3 or lower.

**Patches**

This vulnerability has been patched in TinyMCE 4.9.7 and 5.1.4 by improved parser logic and HTML sanitization.

**Workarounds**

The workarounds available are:

*   disable the impacted plugins
*   manually sanitize the content using the BeforeSetContent event (see below)
*   upgrade to either TinyMCE 4.9.7 or TinyMCE 5.1.4

**Example: Manually sanitize content**

editor.on('BeforeSetContent', function(e) {
  var sanitizedContent \= ...; // Manually sanitize content here
  e.content \= sanitizedContent;
});

**Acknowledgements**

Tiny Technologies would like to thank Michał Bentkowski for discovering this vulnerability.

**References**

https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes

**For more information**

If you have any questions or comments about this advisory:

*   Open an issue in the TinyMCE repo
*   Email us at infosec@tiny.cloud

CVE-2020-23066: Cross-site scripting vulnerability in TinyMCE

Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) vulnerability via the deviceId parameter in the Parental Control module.

    # Exploit Title: Stored Cross-Site scripting in the Tenda router via the deviceId parameter in the Parental Control module# Google Dork: None.# Date: Aug-30-2022# Exploit Author: 0x783# Vendor Homepage: https://tendacn.com/default.html# Software Link: https://www.tendacn.com/product/download/AC6.html# Version: AC6 AC1200 Smart Dual-Band WiFi Router - V15.03.06.50_multi# Tested on: Linux 5.15.0-58-generic# CVE : CVE-2022-40010-------------------------------------------------------------------------# 1. Technical Description:Tenda AC6 AC1200 Smart Dual-Band WiFi Router V15.03.06.50 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the deviceId parameter in the parental control section.# Steps to reproduce:1- Navigate to the router webserver usually at "http://192.168.0.1", or whatever the address of the router is.2- Navigate to the parental control section from the side bar.3- Add a new device to the list with any fake MAC address, device name, URL.4- Intercept the request using burpsuite and change the "deviceId" parameter to any javascript code (EX: <script>alert(document.domain")</script>).5- A pop-up with the domain should appear.

CVE-2022-40010: Tenda AC6 AC1200 15.03.06.50_multi Cross Site Scripting ≈ Packet Storm

A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.

SEC Consult Vulnerability Lab Security Advisory < 20230517-0 >  
=======================================================================  
               title: Stored XSS vulnerability in rename functionality  
             product: Wekan (Open-Source kanban)  
  vulnerable version: <=6.74  
       fixed version: 6.75 or higher  
          CVE number: CVE-2023-28485  
              impact: Medium  
            homepage: https://wekan.github.io  
               found: 2022-12-30  
                  by: Heiner Liesegang (Office Berlin)  
                      SEC Consult Vulnerability Lab

                      An integrated part of SEC Consult.  
                      SEC Consult is part of Eviden, an Atos business  
                      Europe | Asia | North America  
                      https://www.sec-consult.com

=======================================================================

Vendor description:  
-------------------  
"WeKan ® is an completely Open Source and Free software collaborative  
kanban board application with MIT license.

Whether you’re maintaining a personal todo list,  
planning your holidays with some friends,  
or working in a team on your next revolutionary idea, Kanban boards  
are an unbeatable tool to keep your things organized.  
They give you a visual overview of the current state of your project,  
and make you productive by allowing you to focus on the few items that  
matter the most."

Source: https://github.com/wekan/wekan

Business recommendation:  
------------------------  
Patch the application with the latest update supplied by the vendor.

Vulnerability overview/description:  
-----------------------------------  
1) Stored Cross-Site Scripting (CVE-2023-28485)  
An authenticated attacker with the role 'BoardAdmin' is able to rename  
file attachments of Kanban cards. Being an admin of the Wekan instance  
is not required in order for this exploit to work, as any user can  
obtain 'BoardAdmin' privileges by creating a new Kanban board.

The 'renameAttachment' method does not sanitise user input and allows embedding  
XSS payloads in the specified filename. The stored XSS payload is triggered by  
opening the attachment as the modified filename is displayed in the header bar  
of the file preview.

Proof of concept:  
-----------------  
1) Stored Cross-Site Scripting (CVE-2023-28485)  
The following steps are necessary to exploit the vulnerability:  
   1. Log into the application with at least "user" privileges  
  2a. Open a Kanban board in which you have 'BoardAdmin' privileges  
  2b. Or, create a new Kanban board otherwise  
   3. Create a Kanban card if none exists  
   4. Open Kanban card to edit it  
   5. If there is no attachment in the card, upload one  
   6. Click on "Attachment Actions" under the attachment and select "Rename"  
   7. Include arbitrary XSS payload such as the following inside the filename:  
      "<script>alert('Stored XSS')</script>"  
   8. Select "Save" to embed the XSS payload

Any user with access to the board clicking on the attachment preview  
triggers the stored XSS. In case the used Kanban board is set to "public"  
any person with a link to the board can access the targeted card and  
trigger the payload inside the attachments' filename.

Vulnerable / tested versions:  
-----------------------------  
The following versions have been tested to be vulnerable:  
* v6.64  
* v6.69  
* v6.71

According to the vendor, all versions before 6.75 are affected as well.

Vendor contact timeline:  
------------------------  
2023-02-16: Contacting vendor security contact through support@wekan.team.  
2023-02-21: Vendor responded requesting a recheck of fixes in version 6.75.  
2023-02-27: Security patch is confirmed to fix vulnerability.  
2023-03-14: CVE number requested.  
2023-05-17: Public release of security advisory.

Solution:  
---------  
The vendor provides a patched version which should be installed immediately.  
The version 6.75 or higher provides the corresponding security patch:  
https://github.com/wekan/wekan

Workaround:  
-----------  
None

Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult is part of Eviden, an Atos business  
Europe | Asia | North America

About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, part  
of Eviden, an Atos business. It ensures the continued knowledge gain of SEC  
Consult in the field of network and application security to stay ahead of the  
attacker. The SEC Consult Vulnerability Lab supports high-quality penetration  
testing and the evaluation of new offensive and defensive technologies for our  
customers. Hence our customers obtain the most current information about  
vulnerabilities and valid recommendation about the risk profile of new  
technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: http://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult

EOF Heiner Liesegang / @2023

Tag

#xss