[NT] Lil'HTTP Pbcgi.cgi XSS Vulnerability

From: support@securiteam.com
Date: 07/18/02


From: support@securiteam.com
To: list@securiteam.com
Date: Thu, 18 Jul 2002 07:36:00 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Lil'HTTP Pbcgi.cgi XSS Vulnerability
------------------------------------------------------------------------

SUMMARY

Recently, we have reported on a vulnerability in the Urlcount.cgi script
of Lil'HTTP Server (Summit Computer Networks). This time, another CGI
(pbcgi.cgi) has been found vulnerable to cross-site scripting.

DETAILS

Some versions of this CGI will take the form input you POST/GET to it, and
break it into name/e-mail. It does not properly sanitize the input used in
this process, making it vulnerable to cross-site scripting attacks.

Although the entire form data string is not decoded (and thus is not
vulnerable to XSS in most browsers), the "Name" and "E-mail" strings that
the CGI creates ARE decoded, resulting in a security issue:

http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%
28%27xss%27%29%3B%3C%2FSCRIPT%3E

Workaround:
Vulnerable administrators should remove the pbcgi.cgi application from
their CGI-BIN folder.

ADDITIONAL INFORMATION

The information has been provided by <mailto:mattmurphy@kc.rr.com>
Matthew Murphy.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NT] Cross-Site Scripting in Verisigns haydn.exe CGI Script
    ... Get your security news from a reliable source. ... Cross-Site Scripting in Verisign's haydn.exe CGI Script ... A cross-site scripting vulnerability found in Verisign's haydn.exe could ... sure that the web browser is configured to allow Javascript execution. ...
    (Securiteam)
  • SecurityFocus Microsoft Newsletter #165
    ... Tenable Security ... distribute, manage, and communicate vulnerability and intrusion detection ... Microsoft Internet Explorer MHTML Forced File Execution Vuln... ...
    (Focus-Microsoft)
  • SecurityFocus Microsoft Newsletter #174
    ... This issue sponsored by: Tenable Network Security ... the worlds only 100% passive vulnerability ... MICROSOFT VULNERABILITY SUMMARY ... Novell Netware Enterprise Web Server Multiple Vulnerabilitie... ...
    (Focus-Microsoft)
  • [NT] Cumulative Security Update for Internet Explorer (MS04-038)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Get your security news from a reliable source. ... CSS Heap Memory Corruption Vulnerability, ... Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6 ...
    (Securiteam)
  • SecurityFocus Microsoft Newsletter #171
    ... Better Management for Network Security ... GoodTech Telnet Server Remote Denial Of Service Vulnerabilit... ... ASPApp PortalAPP Remote User Database Access Vulnerability ...
    (Focus-Microsoft)