Security Advisory – Magento Multiple Cross-Site Scripting Vulnerabilities

Sense of Security – Security Advisory – SOS-09-002

Details.

Magento is an ecommerce application. During an application penetration test Sense of Security identified multiple cross-site scripting vulnerabilities in the administrator logon, administrator password reminder and update downloader features of the Magento application. This occurred as a result of the application not properly filtering HTML tags which allowed malicious JavaScript to be embedded. When input is incorrectly validated and not properly sanitised and then displayed in a web page, attackers can trick users into viewing the web page and causing malicious code to be executed.

Proof of concept.

The following steps were tested prior to releasing this document on the Magento demo site at:

http://demo-admin.magentocommerce.com/index.php/admin/

Admin Login Page:

On a failed login, the value entered into the username field of the admin login page is reflected back to the user without any output encoding.

Steps to reproduce:

1. Go to http://magento/index.php/admin/

2. Enter the following into the username field:

"

3. Enter a nonsense value into the password field such as ‘xxx’

4. Click the Login button

5. You will be presented with a JavaScript alert dialog box containing ‘xss’

Password Reminder:

The password reminder function contains a similar vulnerability to the previous one. The value of the email address field is reflected back to the user without any output encoding if the entered email does not exist.

Steps to reproduce:

1. Go to http://magento/index.php/admin/index/forgotpassword/

2. Enter the following into the email address field:

"

3. Click the Retrieve Password button

4. You will be presented with a JavaScript alert dialog box containing ‘xss’

Magento Connect Downloader:

The Downloader contains a slightly different bug to two previously described. The ‘return’ parameter of the URL query string is inserted into an tag with no output encoding to facilitate the ‘Return to Magento Administration’ link.