CVE-2008-1385

Vulnerability

The Top Referrers (also known as referrer) plugin in Serendipity (S9Y) before version 1.3.1 contains a cross-site scripting (XSS) vulnerability. The plugin does not escape the Referer HTTP header value when displaying it, allowing an attacker to inject arbitrary web script or HTML [1], [2].

Exploitation

An attacker can send a crafted HTTP request to a vulnerable Serendipity blog with a malicious Referer header containing JavaScript. For example, using wget --referer='http://' http://someblog.com/ the injected payload is stored by the referrer plugin and subsequently executed in the browser of any administrator or visitor who views the referrers page [2]. No authentication is required to trigger the stored XSS; the attacker only needs to make the request to the blog.

Impact

Successful exploitation leads to execution of arbitrary JavaScript in the context of the Serendipity administration interface. This can result in session hijacking, defacement, or theft of sensitive information. The XSS is persistent (stored), increasing the chance of affecting multiple users [1], [2].

Mitigation

Upgrade to Serendipity 1.3.1, released on 2008-04-22, which addresses this issue [1]. No workaround is available for earlier versions. The vulnerability is not listed on the CISA KEV catalog.