-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SA0006 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ +++++ VHCS 2.x HTTP Error Cross Site Scripting +++++ +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ PUBLISHED ON Nov 22, 2005 PUBLISHED AT http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt.sig PUBLISHED BY Moritz Naumann IT Consulting & Services Hamburg, Germany http://moritz-naumann.com/ SECURITY at MORITZ hyphon NAUMANN d0t COM GPG key: http://moritz-naumann.com/keys/0x277F060C.asc AFFECTED APPLICATION OR SERVICE VHCS http://www.vhcs.net/ VHCS, the Virtual Hosting Control System, is a virtual hosting management application. AFFECTED VERSIONS Version 2.2.0 up to and including 2.4.6.2 BACKGROUND Cross Site Scripting, also known as XSS or CSS, describes the injection of malicious content into output produced by a web application. A common attack vector is the inclusion of arbitrary client side script code into the applications' output. Failure to completely sanitize user input from malicious content causes a web application to be vulnerable to Cross Site Scripting. http://en.wikipedia.org/wiki/XSS http://www.cgisecurity.net/articles/xss-faq.shtml ISSUE VHCS is subject to a XSS vulnerability on its HTTP error messages. This issue is caused by lack of input sanitation in vhcs/gui/errordocs/index.php which returns unfiltered web server environment variables. Successful exploitation may allow for impersonification through session stealing attacks. The following URL demonstrates this issue: [vhcs_basedir]/dev/inputvalidation%3Cscript%3Ealert(window.location.hash )%3B%3C/script%3E#XSS WORKAROUND Client: Disable Javascript. Server: Prevent access to vulnerable file(s). SOLUTIONS Moritz Naumann IT Consulting & Services has crafted a unified diff patch against VHCS 2.4.6.2 which is available at http://moritz-naumann.com/adv/0006/vhcsxss/patch/index.php.diff VHCS developers may provide a fix in the 2.6 release. A release date is not currently set. TIMELINE Oct 06, 2005 Discovery Oct 06, 2005 Code maintainer notified Oct 06, 2005 Code maintainer replies Nov 22, 2005 Public disclosure REFERENCES N/A ADDITIONAL CREDIT N/A LICENSE Creative Commons Attribution-ShareAlike License Germany http://creativecommons.org/licenses/by-sa/2.0/de/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFDg4l+n6GkvSd/BgwRAnhcAKCEfl0VO/XNXvL9ltSkJzWMBnsGxwCdE269 2TBoq12ltOuH467cZqOUy1k= =IIUA -----END PGP SIGNATURE-----