[SECURITY ISSUE] CVE-2015-1864: Multiple HTML and Javascript injections

[Kallithea Security Team]

Dear users,

We've discovered a security issue in Kallithea. We recommend you to
upgrade your instances to avoid possible attacks. The details of the
security notice follow below.

Synopsis
========

Several vulnerabilities have been found in Kallithea, allowing
attackers to inject malicious code into the administration pages.

Description
===========

HTML and Javascript injection was possible in several places in the
Kallithea UI, allowing attackers to run malicious code.

User details (first name, last name) as well as repository, repository
group and user group descriptions were pasted unfiltered into the HTML
code, thus attacker could inject their code by setting their first name
to, for example:

    <img src="/images/kallithea-logo.svg" onload="alert('Hello,
    World!');">

This would display an alert every time users administration page. Used
against a user with administrator's access, this can expose sensitive
information:

    <img src="/images/kallithea-logo.svg"
        onload="$.ajax({url:'/_admin/my_account/api_keys'}).done(function(data){
        a=new RegExp('[0-9a-z]{40}','g');alert('Your API key is:'+
        data.substr(data.search(a), 40));});">

Impact
======

As the vulnerability allows attacker to execute arbitrary code in the
user's browser, it can be used to gain access to the user's account by
stealing user's credentials, like API keys. In the case the user also
has administrator rights, it is possible for the attacker to gain full
administrator access to the Kallithea instance.

Resolution
==========

Kallithea project has fixed this issue, and issued a patch and a bugfix
release.

Users are recommended to apply the patch or to upgrade to the latest
0.2.1 release.

Affected versions
=================

The issue is currenly present in Kallithea versions before 0.2.1.

Acknowledgments
===============

Thanks to Nick High for reporting this issue.

References
==========

[1] CVE-2015-1864
    <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1864>

[2] Kallithea: Security Notice CVE-2015-1864
    <https://kallithea-scm.org/security/cve-2015-1864.html>

[3] Patch for the issue
    <https://kallithea-scm.org/security/cve-2015-1864.patch>

[4] Mercurial changeset fixing the issue
    <https://kallithea-scm.org/repos/kallithea/changeset/a8f2986afc18c9221bf99f88b06e60ab83c86c55>

-- 
Cheers,
  Andrew Shadura
  on behalf of Kallithea Security Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://lists.sfconservancy.org/pipermail/kallithea-general/attachments/20150414/86bfcd36/attachment.sig>