(B)(F)uzzing on my world: :::SPAS3C-WV-001::: Multiple Vulnerabilities in ILIAS 4.0.3

== BRIEFING ==

Ilias is a LMS (Learning Management System) created by a german university. It's used by universities, schools and high schools around the world.

This document is the advisory sent to Ilias Security Team, therefore it is written in present time.

Personally, I've worked previously with this team and vulnerabilities was patched in short time, but this release takes almost two months. Anyway, I think that it is a punctual fact.

Examples are tested against my old university. I had already finished XD.

I know that my english is :( but it was enough to help.

Credits given: 4.0.5 Release Notes

TITLE: MULTIPLE VULNERABILITIES IN ILIAS 4.0.3 (2010-01-26)

AUTHOR:JOSÉ A. VÁZQUEZ GONZÁLEZ

IMPACT: COOKIE STEALING AND MORE (MULTIPLE)]

DISCOVERED DATE: 2010-02-19

== DISCLAIMER ==

The information in this advisory and any of its demonstrations is provided "as is" without any warranty of any kind.

I am not liable for any direct or indirect damages caused as a result of using the information or demonstrations provided in any part of this advisory.

== FIRST: SIMPLE BUG (NOT INJECTABLE) ==

Risk: Low

Using tag GET var, we could stop comments, but here XSS or HTML INJECTIONS is not possible, this would be a simple BUG.

Go to --> http://[HOST]/ilias.php?col_side=right&block_type=pdtag&tag=[BUG]&cmd=showResourcesForTag&cmdClass=ilpdtaggingblockgui&cmdNode=4f:6c:7k&baseClass=ilPersonalDesktopGUI

-> Issue in [BUG]

Example -> http://[HOST]/docencia/ilias.php?col_side=right&block_type=pdtag&tag=--%3E%20%26%23%3C&cmd=showResourcesForTag&cmdClass=ilpdtaggingblockgui&cmdNode=4f:6c:7k&baseClass=ilPersonalDesktopGUI

Fig. 1: Simple bug.

This will be the HTML source code returned:

... --> &#" id="block_pdcontent_0_blimg" /> -->

We use End Comment Tag (-->).

Anyway, html tags are restricted so this isn't exploitable with a HTML or XSS Injection.

== SECOND: XSS O HTML INJECTION (PERSISTENT) ==

Risk: Medium

Edit your profile in -> http://[HOST]/ilias.php?cmd=showPersonalData&cmdClass=ilpersonalprofilegui cmdNode=4f:6q&baseClass=ilPersonalDesktopGUI

Changing Personal Information, setting for Street, City and Country:

XSS by J. A. Vazquez " onmouseover="alert('J.A. Vazquez');//

Save this changes.

Now go to Location --> http://[HOST]/ilias.php?cmd=showLocation&cmdClass=ilpersonalprofilegui&cmdNode=4f:6q&baseClass=ilPersonalDesktopGUI

When you move mouse in input tag, with value: "XSS by J. A. Vazquez", XSS is triggered.

Fig. 2: XSS triggered.

Note: This XSS is persistent, in control event, but this only affects my account. Therefore It's medium Risk.

== THIRD: XSS O HTML INJECTION (PERSISTENT) ==

Risk: High

Again Edit your profile in -> http://[HOST]/ilias.php?cmd=showPersonalData&cmdClass=ilpersonalprofilegui cmdNode=4f:6q&baseClass=ilPersonalDesktopGUI

Changing departament parameter for:

");alert('XSS by J.A. Vazquez');//

Saving changes, we bypass protection in CDATA...

Now we go to Public Profile and set "Departament" as visible.

Then, go to location and set "show in personal profile".

Now if a user visit our profile, he could be owned with xss attack.

For example. Going to --> http://[HOST]/repository.php?ref_id=34153&cmdClass=ilpublicuserprofilegui&user=742&cmd=getHTML&cmdNode=1f:ej:6p

Fig. 3: Direct and Persistent XSS

Note: This XSS could be reproduced using other vars (any of location, for example, city, street or view) (No tested but it's probably). This XSS is persistent and it doesn't need a javascript event for triggering. It's triggered in page load.

== FOURTH: XSS O HTML INJECTION (PERSISTENT) ==

Risk: Medium

Go to bookmark section and create a folder, then set a new bookmark in this folder with:

Title: Nice XSS by J.A. Vazquez
Description: Nice XSS by J.A. Vazquez
URL: aa" onmouseover="alert('Creado por J.A. Vazquez!');