CVE-2011-3642
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in Flowplayer Flash versions 3.2.7 through 3.2.16 that allows attackers to inject malicious scripts via plugin configuration directives. It affects TYPO3 News system extension and Mahara installations using vulnerable Flowplayer Flash components. Attackers can execute arbitrary JavaScript in victims' browsers when they visit compromised pages.
💻 Affected Systems
- Flowplayer Flash
- TYPO3 News system extension
- Mahara
📦 What is this software?
Flowplayer Flash by Flowplayer
Flowplayer Flash by Flowplayer
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, credential theft, and malware distribution to all users visiting affected pages.
Likely Case
Session hijacking, credential theft, and defacement of web pages for users accessing vulnerable components.
If Mitigated
Limited impact with proper content security policies, input validation, and user awareness about suspicious links.
🎯 Exploit Status
Exploitation requires tricking users into visiting maliciously crafted URLs or pages containing the XSS payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Flowplayer Flash 3.2.17 or later
Vendor Advisory: http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009
Restart Required: No
Instructions:
1. Update Flowplayer Flash to version 3.2.17 or later. 2. Update TYPO3 News extension to patched version. 3. Update Mahara to latest version if affected. 4. Clear browser and server caches.
🔧 Temporary Workarounds
Disable external plugin loading
allConfigure Flowplayer Flash to only load plugins from trusted, internal domains
Modify Flowplayer configuration to set 'plugins' directive to internal URLs only
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add 'Content-Security-Policy: script-src 'self'' to HTTP headers
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all plugin configuration parameters
- Deploy web application firewall (WAF) rules to detect and block XSS attempts
🔍 How to Verify
Check if Vulnerable:
Check Flowplayer Flash version in web application configuration files and verify if version is between 3.2.7 and 3.2.16Check Version:
grep -r 'flowplayer' /path/to/webroot/ | grep -i versionVerify Fix Applied:
Confirm Flowplayer Flash version is 3.2.17 or later and test plugin configuration with malicious inputs📡 Detection & Monitoring
Log Indicators:
- Unusual plugin configuration requests
- External domain references in plugin directives
- JavaScript execution errors from unexpected sources
Network Indicators:
- HTTP requests with suspicious plugin parameters
- External script loading from untrusted domains
SIEM Query:
web_requests WHERE url CONTAINS 'plugin' AND (url CONTAINS 'javascript:' OR url CONTAINS 'data:' OR url CONTAINS 'http://' OR url CONTAINS 'https://')🔗 References
- http://appsec.ws/Presentations/FlashFlooding.pdf
- http://secunia.com/advisories/52074
- http://secunia.com/advisories/54206
- http://secunia.com/advisories/58854
- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009
- http://web.appsec.ws/FlashExploitDatabase.php
- https://bugs.launchpad.net/mahara/+bug/1103748
- https://code.google.com/p/flowplayer-core/issues/detail?id=441
- https://mahara.org/interaction/forum/topic.php?id=5237
- https://www.securityfocus.com/bid/48651
- http://appsec.ws/Presentations/FlashFlooding.pdf
- http://secunia.com/advisories/52074
- http://secunia.com/advisories/54206
- http://secunia.com/advisories/58854
- http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-009
- http://web.appsec.ws/FlashExploitDatabase.php
- https://bugs.launchpad.net/mahara/+bug/1103748
- https://code.google.com/p/flowplayer-core/issues/detail?id=441
- https://mahara.org/interaction/forum/topic.php?id=5237
- https://www.securityfocus.com/bid/48651
