Gazelle – Multiple Cross-Site Scripting (XSS) in “ocelot_info.php”

[bestshow]

Product: Gazelle
Download: https://github.com/WhatCD/Gazelle
Vunlerable Version: latest version
Tested Version: latest version
Author: ADLab of Venustech

Advisory Details:
Multiple Cross-Site Scripting (XSS) were discovered in “Gazelle latest version”, which can be exploited to execute arbitrary code.
The vulnerabilities exist due to insufficient filtration of user-supplied data in multiple HTTP GET parameters passed to the “Gazelle-master/sections/tools/data/ocelot_info.php” URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
The exploitation examples below use the "alert()" JavaScript function to see a pop-up messagebox:
Poc:
(1)
http://localhost/.../Gazelle-master/sections/tools/data/ocelot_info.php?action=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22
(2)
http://localhost/.../Gazelle-master/sections/tools/data/ocelot_info.php?userid=%22%3E%3Cscript%3Ealert(1);%3C/script%3E%3C%22

[scriptzteam]

:)

https://github.com/scriptzteam/Gazelle---Torrent-Tracker-ANTi-XSS

[bestshow]

Thanks. You mean you have developed this tool to solve these issues which I reported ?

[scriptzteam]

Yep, always around here to help ;) It need custom tweaks as it can strip out or replace some titles (torrent names) but thats just basic edit ...

[kvantor]

I will follow yours patch too ;-)

[lattedesu]

@scriptzteam what if the get/post value is an array ? in your fix (which should be a pull request definitely) I believe you're assuming all given $values are string. Also, does that preg_replace passes non-latin-yet-alphabethic characters?

E.g: what happens when I post something like:

key1 => value1
key2 => [
subkey1 = bad_xss_code
subkey2 = value2
subkey3 = worse_xss_code
]

?