BugTraq
CVE-2015-0955 - Stored XSS in Adobe Experience Manager (AEM) Feb 23 2016 02:01PM
Alexandre Herzog (Alexandre Herzog csnc ch)
#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#############################################################
#
# CSNC ID: CSNC-2015-011
# CVE ID : CVE-2015-0955
# Product: Adobe Experience Manager (AEM) [1]
# Vendor: Adobe [2]
# Subject: Stored Cross-Site Scripting (XSS) Vulnerability
# Risk: Important
# Effect: Exploitable by Authenticated AEM Users
# Author: Damian Pfammatter (damian.pfammatter (at) csnc (dot) ch [email concealed])
# Date: February 23rd 2016
#
#############################################################

Introduction:
-------------
Adobe Experience Manager (AEM) is an enterprise-grade web content management
solution for building
websites, mobile apps and forms [1].

Security Analysts of Compass Security Schweiz AG [3] discovered a stored
Cross-Site Scripting (XSS)
vulnerability, which allows executing JavaScript code in a victim's context,
potentially resulting
in a number of different attack scenarios. For instance, the identified
vulnerability could be used
by a malicious AEM user to publish content in the name of another AEM user.

Affected Versions:
------------------
AEM 6.1.0

Technical Description:
----------------------
Authenticated users in AEM, having permissions to create new folders, may
place malicious JavaScript
code into a folder's title field. Once such a folder gets deleted, the
injected code is executed in
the context of the user deleting the folder. The vulnerability arises due to
improper output
encoding of folder titles in the Deletion popup dialog.

Amongst others, this stored XSS vulnerability could potentially be leveraged
by a low-privileged AEM
user to escalate its privileges. For example, a user having content
management permissions only
could create a folder, which when deleted by another, higher privileged AEM
user, could assign him
administrative privileges. Other type of XSS-related attacks - such as for
instance redirecting
other AEM users to websites abusing browser vulnerabilities to gain local
access - might be
possible.

Hotfix:
-------
Adobe has released a security hotfix (8651) [4] to address this issue.

Timeline:
---------
2015-10-29: Vulnerability discovered
2015-11-23: Initial vendor notification
2015-12-01: Vendor confirmed security issue
2016-02-09: Vendor released security fix & guidance to its customers [4]
2016-02-23: Public disclosure

References:
-----------
[1]:
https://www.adobe.com/marketing-cloud/enterprise-content-management.html

[2]: https://www.adobe.com
[3]: http://www.csnc.ch/advisories
[4]:
https://helpx.adobe.com/security/products/experience-manager/apsb16-05.h
tml
0? *?H?÷
 ?0?10
 `?He0? *?H?÷
 ??0?½0?¥ OÔ/T»/K0
 *?H?÷
0G1 0 UCH10U
 SwissSign AG1!0USwissSign Silver CA - G20
061025083246Z
361025083246Z0G1 0 UCH10U
 SwissSign AG1!0USwissSign Silver CA - G20?"0
 *?H?÷
?0?
?Äñ?Óx1÷8ÉøÃ?C¼Ç÷¼7çNqºK¥s\n?®W®87C/=ÈÎhÁx®+ú,y?öè¹h¹UòD§9
ùü?ñ¢M'ùa{º·å¢¶ëa>ÐlÑæûú^í´? 5[¡?ËðI?þ?
>æÙ âO»Ü?7ü?é25"Ñ:N'?°?2Úa
GM`B®?Gè?ZPXé??¹]¡ÜÝ?J6g»Hä?¶7ëH:¯gèÊïj1?ÔÀ¶ù?q{gd¸¶?JB{e.0j õî?æòÍ?ìÙ¡Jìö²KåE?æmx?.??m6©Ä1d?? *ô5
xÉUÏA°Gé0??¾a¨?¹(z_8Ù©8°?sÁÃ;H*?!?¸Ì¨5Ã??³>¾¤?i:?xÙÉô?«V~[??9?¤
, 2?`³?À*¶ ~IòJùÕF/?£?§&¬»?<æ¼GÜsQñpd/ù´G0lDê)7??hf¼?8þ{9.ÓPðû^
`¶©¦ú'Añ?ròõ?tJÉgÄT®Hdß?Ñn°á??qéLØ¥÷GtÑQ??ó¢#@ sÛK¦çs?Á éÁY¬Fú
æ/øÏq?Fm¹Ä8yEHïÄ]×î?9"?²
XC÷q©H.ýêÖ£¬0©0Uÿ0Uÿ0ÿ0U ÍÁäA
¶:[;ËE½Â?ú?X0U#0? ÍÁäA¶:[;ËE½Â?ú?X0FU ?0=0; `?tY0.0,+ http://repository.swisssign.com/0
 *?H?÷
?sƁà'Ò-à?0â?AP,__ba©?ji tIÖ]?êARoX­PV jƽ(iX?Ü?5©:¼¥`?ØE?iÙ~»xrÁ*Ώ?pa¬ Í ¸9)V?2N?»=Ä*Ù×rîþQ¡"A±qc?°
b«^WßËÝu À]y?àPæÞ1þ?{p_¥Ø­ø¶oÓ`Ý@K"Å=­:z?G?y3º?Ü2i?nKðqþãgr ±¿
\?äú?"Ç?¹#??í%àÏe»õaïݲZA"Z¡?],è[Ém© xª`ÆVZ h¼iyÄ~?¿Åé$Q^ÔÕKSíÙ#Z6e£Á­A0óF?¯eµÕ±ä[xu?zmY©*{ÞÃ???IsxÈ=½Q5t
*Õñ~i*»;½%¸?Z=raf?î ÖMÔt jþ ü£UW?þJË®[Èò#1S8Ò-j??¹j÷^AtnÃ~¬)`??8ÊW
½0/Ç¥æA Ú®?? ¤elL ?º¸Ó¹À??0úå?kNgªÚbV>?fÒÄ6}§>ü?àÔ?彪óN£zjùbrã Oë?#ñ?»|ÜÜl?%²ò´cÒ*g??õÎêØ?jìä
»*Lë `9ÎÊbØ.n0?ù0?á `M©%Û¥?´×20ü0
 *?H?÷
 0V1 0 UCH10U
 SwissSign AG100.U'SwissSign Personal Silver CA 2014 - G220
150817060212Z
180817060212Z0I10U Email Validated Only1(0&UEmail: alexandre.herzog (at) csnc (dot) ch0 [email concealed]?"0
 *?H?÷
?0?
???Csb U?ïÒ0ô9Å°ò SÚ?6ÇïIÓ"ªì3%?Dë|?Э÷îÆ¥w·VÂ)??ØnüÇ¢?BÎ÷¨eò¬=+%x-û¬ËÚ?.?¹è1)cÄ`
6ó[ÎY©C?{sëi=áK?#$?o?k?z¦?Ãé:t?szÀ~ùAsê/qº¦èOù??½ypߣu?eüp0?ýée·Z
?Ç?-¼??M?h(ö[pgÉ=lzÛ??Mn1à"?ZP??RÞD<¢Ç'·zk?ÆΧ8?ÔRÁO
?¡½sP??Î?G?Io?
w3`°'ª±rá0q?]·£?Ï0?Ë0Uÿ°0U% 0
+0U iP?ÍbSÿ³¬ïi ^?Q·Å0U#0?ðÇ£2?µëʵXw§N¾]aC%0ÿU÷0ô0G E C?Ahttp://crl.
swisssign.net/F0C7A33291B5EBCAB5587715A74EBE1A5D6143250¨ ¥ ¢??ldap:/
/directory.swisssign.net/CN=F0C7A33291B5EBCAB5587715A74EBE1A5D614325%2CO
=SwissSign%2CC=CH?certificateRevocationList?base?objectClass=cRLDistribu
tionPoint0aU Z0X0V `?tY0I0G+;http://repository.swisssign.com/SwissSign-Silve
r-CP-CPS.pdf0Ù+Ì0É0d+0?Xhttp://swisssign.net/cgi-bi
n/authority/download/F0C7A33291B5EBCAB5587715A74EBE1A5D6143250a+0
?Uhttp://silver-personal-g2.ocsp.swisssign.net/F0C7A33291B5EBCAB5587715
A74EBE1A5D6143250#U0alexandre.herzog (at) csnc (dot) ch0 [email concealed]
 *?H?÷
 ?j¹#®?13,î®!?ùÇ?7?ÂÀ´?Ù?+¸?õJúðc?f¯xè?xGµ?4w_è|ÐÌ[
P£cq·4Ñ>Ýå 
?7óMÁTï&Ýv:Ö;M?~¨6;ÿÁ?}i`_4??÷¡ÙÖ»SçÙ"?zpº¯ÇÏp4?'´íMQ? ?XÁ>?fææ?7vaC_ldß?Te³®¶¿°Â¤þ¶Ï¿©¯:?ZQ*w7W¡9>KXIIÌÉí¥G)e½1 ?&UtÔ9íºöEüÄgÃó8©|«?ÓLjÅq7áºO\0?ª/<y?n6}i(ù?Ï0?¾0?¦ DÖN­Ó6Õ
2@]¹60
 *?H?÷
 0G1 0 UCH10U
 SwissSign AG1!0USwissSign Silver CA - G20
140919203649Z
290915203649Z0V1 0 UCH10U
 SwissSign AG100.U'SwissSign Personal Silver CA 2014 - G220?"0
 *?H?÷
?0?
?Ë9±9?þúÉ¡¼Ã?©J-?rÿhŧÄìר?³Ñ?@ÜSo=ìèdµ?Û?¼¨¨À?8X^+æÊ0ï²ë
9?G*!årÍÂ1bÌV*ÿwÄc??Âox×µ¶Ìé}3¦?*þÑRÖôì?þMLjRá?vb»¹hæRcüÁ!??]ØÜ?Ñã
IWD?«)É/úÆmk
¡ö÷ÿka5&??i%]i÷½^k?ِ ùC"Ië6Ð Zcã8!Õ+A?Fzògè¤Ðº$'u??I-VÄT3?bùÕ_Þ[©???SÁ?é ´?)2¡Ð¯§£??0??0Uÿ0Uÿ0ÿ0UðÇ
£2?µëʵXw§N¾]aC%0U#0? ÍÁäA¶:[;ËE½Â?ú?X0ÿU÷0ô0G E C?
Ahttp://crl.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA86580¨ ¥
 ¢??ldap://directory.swisssign.net/CN=17A0CDC1E441B63A5B3BCB459DBD1CC2
98FA8658%2CO=SwissSign%2CC=CH?certificateRevocationList?base?objectClass
=cRLDistributionPoint0aU Z0X0V `?tY0I0G+;http://repository.swisssign.com/SwissSign-Silve
r-CP-CPS.pdf0Æ+¹0¶0d+0?Xhttp://swisssign.net/cgi-bi
n/authority/download/17A0CDC1E441B63A5B3BCB459DBD1CC298FA86580N+0
?Bhttp://ocsp.swisssign.net/17A0CDC1E441B63A5B3BCB459DBD1CC298FA86580
 *?H?÷
 ?Ãy§W·{­QhõD?A?(|tÖ;j¼mï§×M9?hÊÙÐq±5?o?ÆI¸QîLùl
oØ¥ûþû0^Ò?«ÄQºª?«jÝ×+J÷²kQÏt[)¢sÞ?þØO !}i °PåX??.åÝczªïùÃi?ä?qb\Bî:òÍàï?\éÎS(2ì? T¢!úP§O¼{²k?)?w>Ê#ÇiZA}
f1ozqyÚ©e:ë×Õ _T|Î7%$?PЯ@4Â_?âz?ó/BG?<BûÙ_¥¼pE?ï 9õ¡xl×ÀgYáÞ\üxèO
Ý»¬?.r?üêGoC(¼»¹??¾úPÝP?L¶vÿÃG
Y´ÍmUØj¶_É/Á?6>¾®@5 íàL-4EC¯¢ôؐåÐÀ?D@®<?Q¼?hsi{uX?·ÔOßñ?q{üweUc×Rr|Ý1G?§?ج&q=#æ;
ô???þ+ê ó&
uÆ?1 çG¡ç©j°¥²Ü=СãnÕðf¦}×??M qçsçsäTeiü7ñopî§l³REgYÖH±!é?(ÙÙô´¦ g#6¼
`G\(]??1º16ÇzBo Ál*øjÙ?2»=U±Åá
±ywTà3?~îê1?¥0?¡0i0V1 0 UCH10U
 SwissSign AG100.U'SwissSign Personal Silver CA 2014 - G22`M©%Û¥?´×20ü0
 `?He ?
0 *?H?÷
 1  *?H?÷
0 *?H?÷
 1
160223140059Z0/ *?H?÷
 1" @ù???µ[, ÀÚ&Ù?IhpG¾ð®£VÖ?&P¸~ 0x +?71k0i0V1 0 UCH10U
 SwissSign AG100.U'SwissSign Personal Silver CA 2014 - G22`M©%Û¥?´×20ü0z *?H?÷
  1k i0V1 0 UCH10U
 SwissSign AG100.U'SwissSign Personal Silver CA 2014 - G22`M©%Û¥?´×20ü0« *?H?÷
 10?0  `?He*0  `?He0
*?H?÷
0  `?He0*?H?÷
?0+0
*?H?÷
@0
*?H?÷
(0  `?He0  `?He0  `?He0+0
 *?H?÷
?D<?î`i²+rUeÍ.ùÔÐ?G-\z8¿)®~?FmV??¡ÿ=ÓM@ÇÁ¨vî»TN0,ËLM\ÙKÿ£
BÌÎñ¤÷'PÖN͍Æ!?Ìj?&$£ãÔÚö?Z'·kaÅÜhi?ë?Õ¼1:mÿ '»ZýÈ@? ðÇÞe¸Ñþ¹ôR?²×vÜKe©ú=F`È`߶ú i?,¥'9Ñ·ñ??öoÙ¦òÎ-æ_µ>B=
/ÐÄPO÷¼x?%ÐjþÜ?³[T×,=?,Ü?èâo+u0µ*uLß
ُ#åxߐ§?ðUýµ<Èÿ90

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus