Who' online

[stitchnkitty]

I just upgraded from g to h - I have run a bunch of tests and have rooted around my admin with no problems yet.

Until now:
Enter Who's Online and I get the popup.

Message from Website
struts_sa_surl_xss.nasl
Then I click OK a number of times and then it is gone.

Also I have about 213 customers in the site all the same?

Does anyone have any ideas where I might have screwed things up?
Thought I had uploaded the files meticulously.

[Vger]

Family CGI abuses : XSS
Nessus Plugin ID 38208 (struts_sa_surl_xss.nasl)
Bugtraq ID 34686
CVE ID CVE-2008-6682

Description:

Synopsis :

The remote host is running a web application with multiple cross-site
scripting vulnerabilities.

Description :

The web application on the remote host is vulnerable to cross-site
scripting attacks. This is likely due to a vulnerable version of
Apache Struts that fails to properly encode the parameters in the
's:a' and 's:url' tags.

A remote attacker could exploit this by tricking a user into
requesting a page with arbitrary script code injected. This could
have consequences such as stolen authentication credentials.

See also :

https://issues.apache.org/jira/browse/WW-2414
https://issues.apache.org/jira/browse/WW-2427
http://www.nessus.org/u?ed70fe34

Solution :

Upgrade to Struts version 2.1.1 / 2.0.11.1 or later.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

From this address:

http://www.nessus.org/plugins/index....ingle&id=38208

Vger

[stitchnkitty]

Oh thank you Vger
I did some checking this morning and it so happens that my scanning company was running a PCI compliance scan at the same time I was doing all my test - how is that for coincidence? Thank you for solve the issue -

[rros]

Just so you know, you should disable the "Who's online" module because it really does contain a XSS vulnerability! I reported this on december 22th, 2010 in the "Reports of Security Problems"-forum, but no-one even responded!

[Vger]

If people are using 1.3.9h then it should not conain any known XSS vulnerabilities. If they are still using .3.8 or earlier then of course they are in trouble.

Vger

[stitchnkitty]

I passed my scan with flying colors - they had an issue with the inconsistent error messages when a folder was not available but that was sovled thru my server.