[NT] acFreeProxy Cross-Site Scripting Vulnerability

From: support@securiteam.com
Date: 11/24/02

  • Next message: support@securiteam.com: "[UNIX] Open WebMail "background" Magic Info" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 24 Nov 2002 08:37:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security would like to welcome Tiscali World Online
    to our service provider team.
    For more info on their service offering IP-Secure,
    please visit http://www.worldonline.co.za/services/work_ip.asp
    - - - - - - - - -

      acFreeProxy Cross-Site Scripting Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://sourceforge.net/projects/acfreeproxy/> acFreeProxy (a.k.a. "
    acFP") is an HTTP/1.x proxy for Microsoft Windows environments. It offers
    caching, and several other features, and has a plug-in format designed for
    extensibility. A flaw in the product may allow attackers to execute
    content across domains.

    DETAILS

    Vulnerable systems:
      * acFP version 1.33-beta7

    The proxy server may generate an error message if given a host that it
    cannot reach, or some other exceptional condition. The error page
    generated during this process does not have any input validation, and is
    vulnerable to cross-site scripting. This allows an attacker to inject code
    as any site the victim can visit, because this problem is in the proxy,
    and not a specific site.

    Impact:
    This vulnerability is significantly more dangerous than any site-specific
    flaw, as it can be exploited to read content from any domain, instead of
    the limited scope of a typical cross-site scripting flaw, where the site
    that is flawed is the only site that can be impacted.

    Exploit:
    http://www.hotmail.com:41997/%3CSCRIPT%3Ealert%28document%3EURL%29%3C/SCRIPT%3E/

    If a vulnerable proxy is being run, script execution begins.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:mattmurphy@kc.rr.com>
    Matthew Murphy.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

    Relevant Pages