Re: XSS in HTDIG

From: Henrik Edlund (henrikat_private)
Date: Fri Jun 28 2002 - 10:06:29 PDT

Next message: Matt Moore: "wp-02-0002: 'WEB-INF' Folder accessible in Multiple Web Application Servers"

Previous message: Peter Watkins: "Re: XSS in HTDIG"
In reply to: Peter Watkins: "Re: XSS in HTDIG"
Next in thread: webmaster (Stephen Ostermiller): "Re: XSS in HTDIG"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, 27 Jun 2002, Peter Watkins wrote:

PW> What version is this? With the sample templates in ht://Dig version
PW> 3.1.6, the "words" info seems to be properly escaped -- I just see the
PW> <script> stuff inside the text input box, and translated on the page.
PW> For example,
PW>
PW> http://www.htdig.org/cgi-bin/htsearch?config=htdig;words=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E
PW>
PW> My example URL suggests that version 3.1.5 is also immune, though 3.1.5
PW> has other issues that 3.1.6 resolves -- see
PW>    http://online.securityfocus.com/bid/3410 and
PW>    http://www.htdig.org/index.html

Version 3.2.0b3 seems to be vunerable.

-- 
http://www.edlund.org/

Next message: Matt Moore: "wp-02-0002: 'WEB-INF' Folder accessible in Multiple Web Application Servers"
Previous message: Peter Watkins: "Re: XSS in HTDIG"
In reply to: Peter Watkins: "Re: XSS in HTDIG"
Next in thread: webmaster (Stephen Ostermiller): "Re: XSS in HTDIG"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Jun 28 2002 - 13:33:26 PDT