[NT] Lil'HTTP Pbcgi.cgi XSS Vulnerability
From: support@securiteam.comDate: 07/18/02
- Previous message: support@securiteam.com: "[UNIX] PHP fopen() Warning Cross-Site Scripting Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: support@securiteam.com To: list@securiteam.com Date: Thu, 18 Jul 2002 07:36:00 +0200 (CEST)
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -
Lil'HTTP Pbcgi.cgi XSS Vulnerability
------------------------------------------------------------------------
SUMMARY
Recently, we have reported on a vulnerability in the Urlcount.cgi script
of Lil'HTTP Server (Summit Computer Networks). This time, another CGI
(pbcgi.cgi) has been found vulnerable to cross-site scripting.
DETAILS
Some versions of this CGI will take the form input you POST/GET to it, and
break it into name/e-mail. It does not properly sanitize the input used in
this process, making it vulnerable to cross-site scripting attacks.
Although the entire form data string is not decoded (and thus is not
vulnerable to XSS in most browsers), the "Name" and "E-mail" strings that
the CGI creates ARE decoded, resulting in a security issue:
http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%
28%27xss%27%29%3B%3C%2FSCRIPT%3E
Workaround:
Vulnerable administrators should remove the pbcgi.cgi application from
their CGI-BIN folder.
ADDITIONAL INFORMATION
The information has been provided by <mailto:mattmurphy@kc.rr.com>
Matthew Murphy.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Previous message: support@securiteam.com: "[UNIX] PHP fopen() Warning Cross-Site Scripting Vulnerability"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
