oss-sec mailing list archives
CVE request: Javamelody blind XSS through X-Forwarded-For header
From: Rafael Luque <rafael.luque.leiva () gmail com>
Date: Thu, 26 Sep 2013 20:01:45 +0200
Javamelody [1] includes a blind XSS vulnerability. An attacker could provide an specially-crafted "X-Forwarded-For" HTTP header while visiting a Java web application monitored with Javamelody that would lead to arbitrary HTML or Javascript execution in the context of the administrator user monitoring the panel of active sessions in the application. The versions affected are the last one 1.46 and all the previous that include the session monitoring panel feature. The issue has been reported to the project [2] but whithout response by now. The proof of concept may use the own Javamelody online demo: 1. Access the demo site [3] using a fake X-Forwarded-For header like the following: <script>alert('xss')</script> 2. Then visit the Javamelody sessions monitoring page at [4] and you should see the Javascript running. Can you allocate a CVE identifier for this? Thank you && Regards, Rafael Luque [1] https://code.google.com/p/javamelody/ [2] https://code.google.com/p/javamelody/issues/detail?id=346 [3] http://demo.javamelody.cloudbees.net/ [4] http://demo.javamelody.cloudbees.net/monitoring?part=sessions
Current thread:
- CVE request: Javamelody blind XSS through X-Forwarded-For header Rafael Luque (Sep 26)
- Re: CVE request: Javamelody blind XSS through X-Forwarded-For header Kurt Seifried (Sep 26)
- Re: CVE request: Javamelody blind XSS through X-Forwarded-For header Rafael Luque (Sep 27)
- Re: CVE request: Javamelody blind XSS through X-Forwarded-For header Kurt Seifried (Sep 26)