VuFind 1.0 Reflected XSS (Cross-site Scripting) Application 0-Day Web Security Bug

VuFind 1.0 Reflected XSS (Cross-site Scripting) Application 0-Day Web Security Bug



Exploit Title: VuFind Results? &lookfor parameter Reflected XSS Web Security Vulnerability
Product: VuFind
Vendor: VuFind
Vulnerable Versions: 1.0
Tested Version: 1.0
Advisory Publication: September 20, 2015
Latest Update: September 25, 2015
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference:
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 8.6
CVSS Version 2 Metrics:
Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism
Access Complexity: Medium
Authentication: Not required to exploit
Impact Type: Allows unauthorized modification
Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:


(1) Vendor & Product Description:


Vendor:
VuFind



Product & Vulnerable Versions:
VuFind
1.0



Vendor URL & Download:
Product can be obtained from here,
http://sourceforge.net/p/vufind/news/




Product Introduction Overview:
"VuFind is a library resource portal designed and developed for libraries by libraries. The goal of VuFind is to enable your users to search and browse through all of your library's resources by replacing the traditional OPAC to include: Catalog Records, Locally Cached Journals, Digital Library Items, Institutional Repository, Institutional Bibliography, Other Library Collections and Resources. VuFind is completely modular so you can implement just the basic system, or all of the components. And since it's open source, you can modify the modules to best fit your need or you can add new modules to extend your resource offerings. VuFind runs on Solr Energy. Apache Solr, an open source search engine, offers amazing performance and scalability to allow for VuFind to respond to search queries in milliseconds time. It has the ability to be distributed if you need to spread the load of the catalog over many servers or in a server farm environment. VuFind is offered for free through the GPL open source license. This means that you can use the software for free. You can modify the software and share your successes with the community! Take a look at our VuFind Installations Wiki page to see how a variety of organizations have taken advantage of VuFind's flexibility. If you are already using VuFind, feel free to edit the page and share your accomplishments. "






(2) Vulnerability Details:
VuFind web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. VuFind has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".


(2.1) The code flaw occurs at "lookfor?" parameter in "/vufind/Resource/Results?" page.

Some other researcher has reported a similar vulnerability here and VuFind has patched it.
https://vufind.org/jira/si/jira.issueviews:issue-html/VUFIND-54/VUFIND-54.html







(3) Solution:
Update to new version.









References:
http://tetraph.com/security/xss-vulnerability/vufind-xss/
http://russiapost.blogspot.ru/2015/09/vufind-xss-issue.html
https://infoswift.wordpress.com/2015/09/25/vufind-issue/
http://www.openwall.com/lists/oss-security/2015/09/25/2
http://whitehatview.tumblr.com/post/129834589981/vufind-xss-bugs 
http://itsecurity.lofter.com/post/1cfbf9e7_854cb25
https://progressive-comp.com/?l=oss-security&m=144316469829656&w=1
http://essayjeans.blog.163.com/blog/static/23717307420158253407863/
http://seclists.org/oss-sec/2015/q3/639
http://frenchairing.blogspot.fr/2015/09/vufind-bug.html
https://itswift.wordpress.com/2015/09/22/vufind-0day/
http://permalink.gmane.org/gmane.comp.security.oss.general/17836

Youth - Time of Beautiful Emotion

Youth is not a time of life; it is a state of mind; it is not a matter of rosy cheeks, red lips and supple knees; it is a matter of the will, a quality of the imagination, a vigor of the emotions; it is the freshness of the deep springs of life.


Youth means a temperamental predominance of courage over timidity, of the appetite for adventure over the love of ease. This often exists in a man of 60 more than a boy of 20. Nobody grows old merely by a number of years. We grow old by deserting our ideals.


Years may wrinkle the skin, but to give up enthusiasm wrinkles the soul. Worry, fear, self-distrust bows the heart and turns the spirit back to dust.


Whether 60 or 16, there is in every human being’s heart the lure of wonders, the unfailing appetite for what’s next and the joy of the game of living. In the center of your heart and my heart, there is a wireless station; so long as it receives messages of beauty, hope, courage and power from man and from the infinite, so long as you are young.


When your aerials are down, and your spirit is covered with snows of cynicism and the ice of pessimism, then you’ve grown old, even at 20; but as long as your aerials are up, to catch waves of optimism, there’s hope you may die young at 80.



From:
http://www.inzeed.com/kaleidoscope/life/youth/

浮生半日 烟火红尘 一念清净 烈焰成池

“半生漂泊，每一次雨打归舟”，浮生半日，烟火红尘，也说饮鸩不止渴，然终是一杯清茶洗过尘心，弦拨心上，山岚依如茶杯上的云烟。谁是谁别了三生三世的影，两吊钱赎回的旧梦遗风，谁还醉唱挽歌浅斟一盏薄情，清酒一壶就醉生梦死了时光。

苦雪烹茶安然度过世界末日，许多人和事都重生了，我想我也会忘了那只乌鸦在末日的方舟上几番徘徊，飞过无痕，狮子却说爱我就让全世界都知道。爱是一 场荨麻 疹，容我再洗净铅华，待千帆过尽。这一别两宽心，各生新欢喜。太阳升起的时候，举目四方宿命繁星。如陈亦迅唱那首苦瓜：当你干杯再举箸，突然间相看莞尔， 某萧瑟晚秋深夜，忽而明了了，而黄叶便碎落。

时间很短，天涯很远。自当终有弱水替三千。今宵请你多珍重，方配这半世流离醉笑三千场离散河两岸，江湖相忘。这杯烈酒下肚，碎一地离殇亦无需你刻意唱一曲骊歌摆渡，烟草的味道，风会把它稀释掉。

麦田几次成熟容我焚香安静的难过，心怀感恩，祈福。

诗经里说：一月气聚，二月水谷，三月驼云，四月裂帛，五月袷衣，六月莲灿，七月兰浆，八月诗禅，九月浮槎，十月女泽，十一月乘衣归，十二月风雪客。微雨突袭的三月桃花春柳拂面的桥头，可有良人云里衣衫？四月裂帛裂了思，陌上花谢了，可徐徐归么？

孰说世间所有的相遇都是久别重逢，亦记得某年某月某日小北说：我可以留着你，也可以放任自由。




期：浮世流光，惜物恋人。一念清净，烈焰成池。

寸寸云文不成文，如果是伤了春悲了秋，写一路醉，哭一路歌，扯断心神，终亦忘却寒山。诗人，你如山的行囊里数

不尽的人间烟柳可载得起这坛醉生梦死？

烟水悠悠，淡酒一盏，十二月风雪客，同年同月同日刮着同个方向同样度数的风，都已不是当时。我想我是在待着一位故人，他还没有来，也许在来的路途上，我且沏好了茶，待着，如此 就好。





转载自蝶比翼美文:
http://diebiyi.com/articles/essay/shishi/