[NEWS] Classic Cross-Site Scripting: Gibson Research Corporation

From: support@securiteam.com
Date: 05/02/02

From: support@securiteam.com
To: list@securiteam.com
Date: Thu,  2 May 2002 09:46:16 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Classic Cross-Site Scripting: Gibson Research Corporation


A security vulnerability has been found in GRC's IIS Advanced Prophylactic
Filter, the vulnerability would allow an attacker to insert malicious HTML
and JavaScript into GRC's existing web site.


Gibson Research Corporation http://www.grc.com is an interesting site
covering a wide variety of security topics for newcomers. Cursory research
suggests that it enjoys a substantial loyal following that trust it

The problem is two-fold:

1. The site has a web based discussion forum
2. The site has a custom 'filter', the so-called: "Gibson Research
Corporation's IIS Advanced Prophylactic Filter"

This custom 'filter' is supposed to protect the server from 'malicious
abuse' and both 'detect and block' invalid requests submitted to the
server: <http://www.grc.com/apf/> http://www.grc.com/apf/

[screen shot: <http://www.malware.com/flitty.png>
http://www.malware.com/flitty.png 25KB]

Unfortunately, what it actually does is allow us to inject our own HTML
code through grc.com's secured server. This is particularly ticklish, as
it does not take much to conjure up a scenario where we construct a 'fake'
e-commerce page, say peddling a book or 'gadget' download, and simply
invite the loyal following to go and submit their credit card details to
our custom form.

The site grc.com well known and trusted. The page is on a secured server
with valid certificates.

Crude Working Example:
Note: custom crafted for Internet Explorer 5.5 and 6

 <http://www.malware.com/grc.html> http://www.malware.com/grc.html

[screen shot: <http://www.malware.com/lucre.png>
http://www.malware.com/lucre.png 11KB]

Vendor response:
Three mail messages within 72 hours to support @ grc.com remain unanswered
to date.


The information has been provided by Anonymous.


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.