Zaep AntiSpam Cross Site Scripting

From: Aviram Jenik (aviram_at_BEYONDSECURITY.COM)
Date: 04/19/04

  • Next message: Roger Thompson: "Call for volunteers to run WormRadar nodes" 
    Date:         Mon, 19 Apr 2004 15:11:09 +0300
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

     Zaep AntiSpam Cross Site Scripting
    ------------------------------------------------------------------------

    Article reference:
    http://www.securiteam.com/windowsntfocus/5EP0I15CKK.html

    SUMMARY

    Beyond Security has discovered a security vulnerability in
    <http://www.zaep.com/> Zaep AntiSpam 2.0, the vulnerability would allow a
    remote attacker to use the Zaep program's CGI to cause it to return third
    party content as if it were its own (A cross-site scripting vulnerability).
    This vulnerability would allow (depending on the web server's configuration
    and site sensitivity) to steal cookies, display alternative information
    (cross-site defacement), or redirect users to malicious sites.

    DETAILS

    Vulnerable Systems:
     * Zaep AntiSpam 2.0

    Immune Systems:
     * Zaep AntiSpam 2.0.0.2

    Once you send an email to an organization protected by Zaep, a URL like:
    http://vulnerable.zaep/?key=3d981f0f.4056b0a6.23285275 is issued. If you
    modify the URL to include <script>something</script>, the Zaep will convert
    the '/' sign to \, making the script clause not work properly. So far, this
    behavior will "protect" the product from a cross-site scripting
    vulnerability. However, double encoding the / sign (%252F) will bypass this
    conversion, and allow you to insert malicious content (JavaScript, HTML, etc)
    into the page.

    Exploit (for all the vulnerabilities):
    http://vulnerable.zaep/?key=>alert(document.cookie)<%252Fscript>

    Vendor response:
    The vendor has been very cooperative and has issued a patch to fix this
    problem as soon as they were notified.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:expert@securiteam.com> Noam
    Rathaus.

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any
    kind.
    In no event shall we be liable for any damages whatsoever including direct,
    indirect, incidental, consequential, loss of business profits or special
    damages.

    -----
    Earn up to 10 credit course hours toward the TruSecure ICSA Practitioner (TICSA) Credential and receive a TICSA exam coupon by attending the Infosecurity Canada 2004 conference. Featured speaker, Marcus J. Ranum, TruSecure inventor of the proxy firewall will present on June 3 at 11:30 AM. Visit <    https://ticsa.trusecure.com> for certification details and <http://www.infosecuritycanada.com> for conference information. Become TICSA certified and see what happens!
    -----

  • Next message: Roger Thompson: "Call for volunteers to run WormRadar nodes"

    Relevant Pages