bugtraq - Re: Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20070622103009.31501.qmail@securityfocus.com>
Date: 22 Jun 2007 10:30:09 -0000
From: scott-REMOVE-@...lletin.com
To: bugtraq@...urityfocus.com
Subject: Re: Re: New Include Redirect Bug XSS All vBulletin(r) v 3.x.x

I fully understand the significance of XSS and the numerous different ways to get it on the server but this focuses directly on the ability to place a web viewable document on the same domain which vBulletin doesn't provide itself.

What the author of this exploit has described is a way to influence a user to visit a link to a crafted page already present on the domain, it isn't traversing out of the directory, its only changing the value of a src or an href parameter.

Short of removing the ability for users to provide links there isn't a way to fix this, and even if we did they could just put the link on anyway and have someone copy and paste.

In my eyes it isn't even an exploit at all, if you can create unsanitised content that is web viewable then there is a more significant problem that needs resolved and it out of our scope to fix.

Scott MacVicar