Advisory: Cross-Site Scripting vulnerability in Serendipity Plugin "serendipity_event_freetag" Advisory ID: SSCHADV2011-004 Author: Stefan Schurtz Affected Software: Successfully tested on: Serendipity 1.5.5 with serendipity_event_freetag - version 3.21 Vendor URL: http://www.s9y.org Vendor Status: Version 3.22 - Fix possible XSS CVE-ID: - ========================== Vulnerability Description: ========================== This is Cross-Site Scripting vulnerability ================== Technical Details: ================== http://www.example.com/serendipity/index.php?/plugin/tag/hallo=> http://www.example.com/serendipity/index.php?/plugin/tag/hallo=> http://www.example.com/serendipity/index.php?/plugin/tag/ http://www.example.com/serendipity/index.php?/plugin/tag/ ========= Solution: ========= Update to the latest version 3.22 diff serendipity_event_freetag.php < add('version', '3.21'); > $propbag->add('version', '3.22'); < $serendipity['smarty']->assign('freetag_tagTitle', is_array($this->displayTag) ? implode(' + ',$this->displayTag) : $this->displayTag); > $serendipity['smarty']->assign('freetag_tagTitle', htmlspecialchars(is_array($this->displayTag) ? implode(' + ',$this->displayTag) : $this->displayTag)); ==================== Disclosure Timeline: ==================== 30-May-2011 - informed developers 30-May-2011 - Release date of this security advisory 30-May-2011 - Version 3.22 - Fix possible XSS 31-May-2011 - post on BugTraq and Full-disclosure ======== Credits: ======== Vulnerability found and advisory written by Stefan Schurtz. =========== References: =========== http://www.s9y.org http://www.rul3z.de/advisories/SSCHADV2011-004.txt http://ha.ckers.org/xss.html http://blog.s9y.org/archives/231-serendipity_event_freetag-Plugin-update,-XSS-bug.html http://www.securityfocus.com/archive/1/518191/30/0/threaded