CVE-2013-1942: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-08-15T17:55Z
Repository: https://github.com/happyworm/jPlayer
Language: Other
Files changed: actionscript/Jplayer.as, actionscript/happyworm/jPlayer/JplayerStatus.as, jquery.jplayer/jquery.jplayer.js
Commit date: 2013-03-21 17:12:38 +0000
Commit message: Security Fix of Flash SWF that had enabled cookie theft

Diff: diff --git a/actionscript/Jplayer.as b/actionscript/Jplayer.as
index 55251b8..b3147ef 100644
--- a/actionscript/Jplayer.as
+++ b/actionscript/Jplayer.as
@@ -6,12 +6,12 @@
  * Dual licensed under the MIT and GPL licenses.
  *  - http://www.opensource.org/licenses/mit-license.php
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.2.19
- * Date: 29th January 2013
+ * Version: 2.2.20
+ * Date: 21st March 2013
  *
  * FlashVars expected: (AS3 property of: loaderInfo.parameters)
  *	id: 	(URL Encoded: String) Id of jPlayer instance
  *	vol:	(Number) Sets the initial volume
  *	muted:	(Boolean in a String) Sets the initial muted state
@@ -68,11 +68,11 @@ package {
 
 		private var isMp3:Boolean = false;
 		private var isVideo:Boolean = false;
 
 		private var securityIssue:Boolean = false; // When SWF parameters contain illegal characters
-		private var directAccess:Boolean = false; // When SWF visited directly with no parameters
+		private var directAccess:Boolean = false; // When SWF visited directly with no parameters (or when security issue detected)
 
 		private var txLog:TextField;
 		private var debug:Boolean = false; // Set debug to false for release compile!
 		private var localAIRDebug:Boolean = false; // This is autodetermined by AIR app - leave false!
 
@@ -231,16 +231,16 @@ package {
 				if(illegalChar(s)) {
 					securityIssue = true; // Illegal char found
 				}
 				i++;
 			}
-			if(i === 0) {
+			if(i === 0 || securityIssue) {
 				directAccess = true;
 			}
 		}
 		private function illegalChar(s:String):Boolean {
-			var illegals:String = "' \" ( ) { } * + /";
+			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
 			if(Boolean(s)) { // Otherwise exception if parameter null.
 				for each (var illegal:String in illegals.split(' ')) {
 					if(s.indexOf(illegal) >= 0) {
 						return true; // Illegal char found
 					}
diff --git a/actionscript/happyworm/jPlayer/JplayerStatus.as b/actionscript/happyworm/jPlayer/JplayerStatus.as
index 600b2b2..7e369d8 100644
--- a/actionscript/happyworm/jPlayer/JplayerStatus.as
+++ b/actionscript/happyworm/jPlayer/JplayerStatus.as
@@ -6,17 +6,17 @@
  * Dual licensed under the MIT and GPL licenses.
  *  - http://www.opensource.org/licenses/mit-license.php
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Date: 29th January 2013
+ * Date: 21st March 2013
  */
 
 package happyworm.jPlayer {
 	public class JplayerStatus {
 
-		public static const VERSION:String = "2.2.19"; // The version of the Flash jPlayer entity.
+		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
 
 		public var volume:Number = 0.5; // Not affected by reset()
 		public var muted:Boolean = false; // Not affected by reset()
 
 		public var src:String;
diff --git a/jquery.jplayer/Jplayer.swf b/jquery.jplayer/Jplayer.swf
index 0518462..cdbf185 100644
Binary files a/jquery.jplayer/Jplayer.swf and b/jquery.jplayer/Jplayer.swf differ
diff --git a/jquery.jplayer/jquery.jplayer.js b/jquery.jplayer/jquery.jplayer.js
index 5b5ff0f..3088d02 100644
--- a/jquery.jplayer/jquery.jplayer.js
+++ b/jquery.jplayer/jquery.jplayer.js
@@ -6,12 +6,12 @@
  * Dual licensed under the MIT and GPL licenses.
  *  - http://www.opensource.org/licenses/mit-license.php
  *  - http://www.gnu.org/copyleft/gpl.html
  *
  * Author: Mark J Panaghiston
- * Version: 2.2.19
- * Date: 29th January 2013
+ * Version: 2.2.20
+ * Date: 21st March 2013
  */
 
 /* Code verified using http://www.jshint.com/ */
 /*jshint asi:false, bitwise:false, boss:false, browser:true, curly:true, debug:false, eqeqeq:true, eqnull:false, evil:false, forin:false, immed:false, jquery:true, laxbreak:false, newcap:true, noarg:true, noempty:true, nonew:true, onevar:false, passfail:false, plusplus:false, regexp:false, undef:true, sub:false, strict:false, white:false smarttabs:true */
 /*global define:false, ActiveXObject:false, alert:false */
@@ -452,12 +452,12 @@
 	$.jPlayer.keys(true);
 
 	$.jPlayer.prototype = {
 		count: 0, // Static Variable: Change it via prototype.
 		version: { // Static Object
-			script: "2.2.19",
-			needFlash: "2.2.19",
+			script: "2.2.20",
+			needFlash: "2.2.20",
 			flash: "unknown"
 		},
 		options: { // Instanced in $.jPlayer() constructor
 			swfPath: "js", // Path to Jplayer.swf. Can be relative, absolute or server root relative.
 			solution: "html, flash", // Valid solutions: html, flash. Order defines priority. 1st is highest,

Vulnerable code:  * Version: 2.2.19
 * Date: 29th January 2013
		private var directAccess:Boolean = false; // When SWF visited directly with no parameters
			if(i === 0) {
			var illegals:String = "' \" ( ) { } * + /";
 * Date: 29th January 2013
		public static const VERSION:String = "2.2.19"; // The version of the Flash jPlayer entity.
 * Version: 2.2.19
 * Date: 29th January 2013
			script: "2.2.19",
			needFlash: "2.2.19",
Fixed code:  * Version: 2.2.20
 * Date: 21st March 2013
		private var directAccess:Boolean = false; // When SWF visited directly with no parameters (or when security issue detected)
			if(i === 0 || securityIssue) {
			var illegals:String = "' \" ( ) { } * + / \\ < > = document";
 * Date: 21st March 2013
		public static const VERSION:String = "2.2.20"; // The version of the Flash jPlayer entity.
 * Version: 2.2.20
 * Date: 21st March 2013
			script: "2.2.20",
			needFlash: "2.2.20",