bugtraq - Cold Fusion Web Server XSS 0 day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 5 Feb 2007 00:26:29 -0000
From: digi7al64@...il.com
To: bugtraq@...urityfocus.com
Subject: Cold Fusion Web Server XSS 0 day

Title: Cold Fusion Web Server XSS 0 day
Own3d by: digi7al64
thx: WhiteAcid
About: Default settings in Cold Fusion server ensure it returns a standardized error page whenever a exception occurs (404,500 etc). This page then echos the user agent, ip and referer back to the user for debugging purposes. Unfortunately though, whilst the referer is encoded to stop xss, the user agent isn't. Hence spoofing of the user agent allows xss to be performed.
Googledork: intitle:Error Occurred While Processing Request.

POC (IE6/IE7 only - can't spoof headers in FF or Opera with flash):
h**p://www.whiteacid.org/misc/xss_headers.php?xss_target=http://www.example.com/&USER_AGENT=%3Cscript%3Ealert(String.fromCharCode(120,115,115))%3C/script%3E&HTTP_REFERER=http://www.google.com/

**Make sure you change http://example.com/ to target url for POC to work**