#web-application

Do you test your web application for accessibility? | Virtuoso QA Blog

It's important to be up to date with the latest standards in accessibility testing. Here's what you need to know - and how Virtuoso can help!

Visit here, https://www.virtuoso.qa/post/do-you-test-your-web-application-for-accessibility

VuFind 1.0 Reflected XSS (Cross-site Scripting) Application 0-Day Web Security Bug

Exploit Title: VuFind Results? &lookfor parameter Reflected XSS Web Security Vulnerability

Product: VuFind

Vendor: VuFind

Vulnerable Versions: 1.0

Tested Version: 1.0

Advisory Publication: September 20, 2015

Latest Update: September 25, 2015

Vulnerability Type: Cross-Site Scripting [CWE-79]

CVE Reference:

Impact CVSS Severity (version 2.0):

CVSS v2 Base Score: 4.3 (MEDIUM) (AV:N/AC:M/Au:N/C:N/I:P/A:N) (legend)

Impact Subscore: 2.9

Exploitability Subscore: 8.6

CVSS Version 2 Metrics:

Access Vector: Network exploitable; Victim must voluntarily interact with attack mechanism

Access Complexity: Medium

Authentication: Not required to exploit

Impact Type: Allows unauthorized modification

Discover and Reporter: Wang Jing [School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore] (@justqdjing)

Caution Details:

(1) Vendor & Product Description:

Vendor:

VuFind

Product & Vulnerable Versions:

VuFind

1.0

Vendor URL & Download:

Product can be obtained from here, http://sourceforge.net/p/vufind/news/

Product Introduction Overview:

"VuFind is a library resource portal designed and developed for libraries by libraries. The goal of VuFind is to enable your users to search and browse through all of your library's resources by replacing the traditional OPAC to include: Catalog Records, Locally Cached Journals, Digital Library Items, Institutional Repository, Institutional Bibliography, Other Library Collections and Resources. VuFind is completely modular so you can implement just the basic system, or all of the components. And since it's open source, you can modify the modules to best fit your need or you can add new modules to extend your resource offerings. VuFind runs on Solr Energy. Apache Solr, an open source search engine, offers amazing performance and scalability to allow for VuFind to respond to search queries in milliseconds time. It has the ability to be distributed if you need to spread the load of the catalog over many servers or in a server farm environment. VuFind is offered for free through the GPL open source license. This means that you can use the software for free. You can modify the software and share your successes with the community! Take a look at our VuFind Installations Wiki page to see how a variety of organizations have taken advantage of VuFind's flexibility. If you are already using VuFind, feel free to edit the page and share your accomplishments. "

(2) Vulnerability Details:

VuFind web application has a computer security problem. Hackers can exploit it by reflected XSS cyber attacks. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

Several other similar products 0-day vulnerabilities have been found by some other bug researchers before. VuFind has patched some of them. "scip AG was founded in 2002. We are driven by innovation, sustainability, transparency, and enjoyment of our work. We are completely self-funded and are thus in the comfortable position to provide completely independent and neutral services. Our staff consists of highly specialized experts who focus on the topic information security and continuously further their expertise through advanced training".

(2.1) The code flaw occurs at "lookfor?" parameter in "/vufind/Resource/Results?" page.

Some other researcher has reported a similar vulnerability here and VuFind has patched it. https://vufind.org/jira/si/jira.issueviews:issue-html/VUFIND-54/VUFIND-54.html

(3) Solution:

Update to new version.

Answer: Mailing List Application? #dev #answer #solution

Mailing List Application?

Mailing lists are great, but they’re a fundamentally different beast than email. It seems strange to me to keep mailing lists in my email program (Gmail). Of course I have folders set up to automatically keep them out of my inbox, but if I have hundreds of mailing lists, it gets really out of hand.

Is there an application (or web application) that is designed…

Today I will be explaining how to get ready for web-application development, First of all, I work on Linux (Ubuntu), to follow my posts I recommend dual-booting your computer. The Ubuntu homepage can explain how to do it.

You can find all source code used in this blog here.

Getting a server

For any application we will need to have a server. Yes you can also type some HTML & Javascript and open the file in your browser, but this will not work for all applications and it is not ideal for testing cross-device.

So how do you get access to a free server?

Work on a local server, so you can access the application on all devices within the LAN

Set up a Google App Engine application, so you can put it on the internet

Both are free solutions to get a place to experiment on. Today we will be working locally, together with NodeJS.

Installing NodeJS

First, install NodeJS, you can download it from the website, or use a package manager and type:

 sudo apt-get install nodejs

into Terminal (remember: Ctrl-Shift-V to paste into Terminal). Now we will need to install NPM, in order to easily install node modules. So let's go to Terminal again and type:

  sudo curl http://npmjs.org/install.sh | sudo sh

Now we have Node & NPM, that means we are ready to get ourselves some awesome modules.

Installing modules

There are two ways of installing a module through NPM. You can install it locally within the directory you work in, or you can install it globally. When you install it locally, NPM creates the directory "node_modules" and each module gets its own directory within it. When you install it globally, it will install it in "usr/lib/node_modules". For now, let's just install all modules globally, I will later explain how to access those modules. You can install a module typing:

sudo npm install module_name -g

So, try it out! Let's install the Express module so we can easily set up our server:

sudo npm install express -g

Your first project

Now that we got our module, we are ready to make a directory for our first project. I actually put all my projects in my Dropbox folder, so they automatically sync to all my other devices, and I am assured I don't lose any work. But you can just create this directory anywhere.

Then create a file called "server.js", and put this code into it:

var express = require('express'), app = module.exports = express.createServer(); app.configure(function(){ app.use(express.bodyParser()); app.use(express.cookieParser()); app.set('view engine', 'html'); app.use(express.methodOverride()); app.use(express.static(__dirname + '/static')); app.use(express.errorHandler({ dumpExceptions: true, showStack: true })); }); app.get('/', function(req, res) { res.redirect('/index.html'); }); app.listen(80); // port 80 = default port browsers look for // you will need root access (sudo node server.js) to run this code

Linking global modules

But there is one problem, when you install a module globally, it is only accessible through node, within your terminal, you can not use "require('express')" like we did, unless you use "npm link". And that is what I prefer. I like to install all my modules globally, and when I start a new project, I pick the modules I need and link them up with my working directory.

So first, go to Terminal, and go to your working directory using

cd path/to/your/directory

and then

sudo npm link express

  Now you should see

./node_modules/express -> /usr/lib/node_modules/express

You're done!

in the Terminal window. Now we can type:

  sudo node server.js

and your server is up and running! However, we don't have the "index.html" file yet, so go to your working directory and make a map called "static", in it, you can place your index file. To view the file, simply go to http://localhost and that's it. Now you can start building apps.

Next post I will be explaining how to:

make your app update when changing a file

access your application within your LAN

other fun stuff I come up with