XSS in Null HTTPd

From: Matthew Murphy (mattmurphyat_private)
Date: Mon Sep 02 2002 - 09:57:11 PDT

Next message: Michael Scheidell: "[Full-Disclosure] SECNAP Security Alert: Radmin Default install options vulnerability"

Previous message: Spybreak: "The ScrollKeeper Root Trap"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Null HTTPd is a simple HTTP server that runs on Win32/Unix systems.  It is
quite basic, but offers good CGI support.  A vulnerability in Null HTTPd may
allow cross-site scripting via a 404 page:

http://localhost/a?x=>alert(document.URL)</SCRIPT>

You have to place this in the query string so that it doesn't get the
typical "%xx..." urlencode treatment from the browser.  If the code is
encoded in any way, it prevents the vulnerability from working.

"The reason the mainstream is thought
of as a stream is because it is
so shallow."
                     - Author Unknown

Next message: Michael Scheidell: "[Full-Disclosure] SECNAP Security Alert: Radmin Default install options vulnerability"
Previous message: Spybreak: "The ScrollKeeper Root Trap"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Sep 02 2002 - 10:08:12 PDT