[NT] Lil'HTTP Pbcgi.cgi XSS Vulnerability

From: support@securiteam.com
Date: 07/18/02 

From: support@securiteam.com
To: list@securiteam.com
Date: Thu, 18 Jul 2002 07:36:00 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  Lil'HTTP Pbcgi.cgi XSS Vulnerability
------------------------------------------------------------------------

SUMMARY

Recently, we have reported on a vulnerability in the Urlcount.cgi script
of Lil'HTTP Server (Summit Computer Networks). This time, another CGI
(pbcgi.cgi) has been found vulnerable to cross-site scripting.

DETAILS

Some versions of this CGI will take the form input you POST/GET to it, and
break it into name/e-mail. It does not properly sanitize the input used in
this process, making it vulnerable to cross-site scripting attacks.

Although the entire form data string is not decoded (and thus is not
vulnerable to XSS in most browsers), the "Name" and "E-mail" strings that
the CGI creates ARE decoded, resulting in a security issue:

http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%
28%27xss%27%29%3B%3C%2FSCRIPT%3E

Workaround:
Vulnerable administrators should remove the pbcgi.cgi application from
their CGI-BIN folder.

ADDITIONAL INFORMATION

The information has been provided by <mailto:mattmurphy@kc.rr.com>
Matthew Murphy.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages