Embedthis Appweb Web Server 3.2.2-1 (Ejscript) Remote XSS Vulnerability





Vendor: Embedthis Software LLC

Product web page: http://www.appwebserver.org, http://www.ejscript.org

Version affected: 3.2.2-1



Summary: Appweb has a multi-threaded, event-driven, core to deliver

exceptional throughput, response and outstanding memory utilization.

It is compact and will embed using as little as 800K of memory.



Desc: Appweb Web Server suffers from a remote reflected Cross-Site

Scripting vulnerability when input passed to the Ejscript web

framework is not properly sanitized, allowing the attacker to

execute arbitrary HTML and script code in a user's browser

session and aid in phishing attacks.



Tested on: Microsoft Windows XP Professional SP3 (EN)



Vulnerability discovered by: Gjoko 'LiquidWorm' Krstic

                             liquidworm gmail com

                             Zero Science Lab - http://www.zeroscience.mk



Advisory ID: ZSL-2010-4985

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4985.php



12.10.2010





PoC:



http://localhost/ejs/%3Cscript%3Ealert%281%29%3C/script%3E