[NEWS] Classic Cross-Site Scripting: Gibson Research Corporation

From: support@securiteam.com
Date: 05/02/02


From: support@securiteam.com
To: list@securiteam.com
Date: Thu,  2 May 2002 09:46:16 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Classic Cross-Site Scripting: Gibson Research Corporation
------------------------------------------------------------------------

SUMMARY

A security vulnerability has been found in GRC's IIS Advanced Prophylactic
Filter, the vulnerability would allow an attacker to insert malicious HTML
and JavaScript into GRC's existing web site.

DETAILS

Gibson Research Corporation http://www.grc.com is an interesting site
covering a wide variety of security topics for newcomers. Cursory research
suggests that it enjoys a substantial loyal following that trust it
implicitly.

The problem is two-fold:

1. The site has a web based discussion forum
2. The site has a custom 'filter', the so-called: "Gibson Research
Corporation's IIS Advanced Prophylactic Filter"

This custom 'filter' is supposed to protect the server from 'malicious
abuse' and both 'detect and block' invalid requests submitted to the
server: <http://www.grc.com/apf/> http://www.grc.com/apf/

[screen shot: <http://www.malware.com/flitty.png>
http://www.malware.com/flitty.png 25KB]

Unfortunately, what it actually does is allow us to inject our own HTML
code through grc.com's secured server. This is particularly ticklish, as
it does not take much to conjure up a scenario where we construct a 'fake'
e-commerce page, say peddling a book or 'gadget' download, and simply
invite the loyal following to go and submit their credit card details to
our custom form.

The site grc.com well known and trusted. The page is on a secured server
with valid certificates.

Crude Working Example:
Note: custom crafted for Internet Explorer 5.5 and 6

 <http://www.malware.com/grc.html> http://www.malware.com/grc.html

[screen shot: <http://www.malware.com/lucre.png>
http://www.malware.com/lucre.png 11KB]

Vendor response:
Three mail messages within 72 hours to support @ grc.com remain unanswered
to date.

ADDITIONAL INFORMATION

The information has been provided by Anonymous.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NT] Vulnerability in HTML Help Allows Code Execution (MS05-001)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... * Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service ...
    (Securiteam)
  • [NT] Microsoft JScript Remote Code Execution (MS06-023)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... There is a remote code execution vulnerability in JScript. ... Configure Internet Explorer to prompt before running Active Scripting ...
    (Securiteam)
  • [NT] Vulnerability in Microsoft XML Core Services Could Allow Remote Code Execution (MS07-042)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Vulnerability in Microsoft XML Core Services Could Allow Remote Code ... mode sets the security level for the Internet zone to High. ...
    (Securiteam)
  • [NT] Cumulative Security Update for Internet Explorer (MS05-052)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... A remote code execution vulnerability exists in the way Internet Explorer ...
    (Securiteam)
  • [NT] Microsoft Data Access Components (MDAC) Function Code Execution (MS06-014)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... Microsoft Data Access Components Function Code Execution ... for the Internet security zone to prompt before running ActiveX controls. ...
    (Securiteam)