JBoss RichFaces Online Persistent Xss Vulnerability

Name : RichFaces Online Persistent Xss Vulnerability Date : Sept,1 2010 Vendor Url : http://exadel.com/web/portal/home Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com> Big hugs : Th3 RDX,Hanan_butt special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr greetz to :www.topsecure.net ,trent Dillman,All ICW members and my friends :) luv y0 guyz ####################################################################################################### Description : JBoss now publishes a listing of projects in production using Seam. (See "Why Seam?" to learn more about Seam.) An interesting aspect of this listing is the huge number of Seam projects that use RichFaces, both in terms of how widespread RichFaces is and how well Seam and RichFaces work together. As the original creators of RichFaces and still the foremost experts on RichFaces, we're very excited to see RichFaces evolve and become an evermore widespread tool for developing rich Internet applications. Bug : Persistent XSS : The persistent Xss is in the sign up form since the the data passed are not santizied properly Attack pattern : '"--><script>alert(/w0Ot/)</script> The attacker can insert xss in the following fields. ############################################################################################################### Snapshot : http://img718.imageshack.us/img718/4465/wooter.png ############################################################################################################### Solution: N/a ############################################################################################################### # 0day no more # Sid3^effects