lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <C9B2DD4DEDB9214A84BB2937ACE45B6D1F42BA@server05.2bsecure.co.il>
Date: Mon Jul 10 01:55:14 2006
From: erezmetula at 2bsecure.co.il (Erez Metula)
Subject: MIMESweeper For Web 5.X Cross Site Scripting

 

MIMESweeper For Web 5.X Cross Site Scripting

 

 

I. INTRODUCTION

 

MIMESweeper For Web is a policy-based content security for web
applications. It analyzes web content and blocks pages or files that are
prohibited by the organizational security policy.

 

For more Information please refer to:

http://www.clearswift.com/products/msw/msw_web/default.aspx

 

 

II. DESCRIPTION

 

A XSS vulnerability was discovered by Erez Metula. When accessing a URL
which is not permitted the user is redirected to an "access denied" page
that is vulnerable to XSS. The page does not input validate / HTML
Encode the input and displays the data "as is".

 

Usually this means that it enables an attacker to inject HTML or
Javascript code into users's browsers, and by that bypassing the browser
DOM restrictions.

This javascript code can perform actions on behalf of the user, steal
authentication cookies, change the appearance of web pages, perform
phishing ,and generally can do everything to the original page.

 

 

III. EXPLOITATION

 

The vulnerability can be exploited by just redirecting the client to
some URL that is restricted by MIMESweeper policy and adding the script
at the end of the URL.

 

Example PoC:

http://SomeBlackListedSite/<script>PAYLOAD</script
<http://someblacklistedsite/%3cscript%3ePAYLOAD%3c/script> >

 

 

IV. IMPACT

 

Using the MIMESweeper capabilities of a central gateway to spread
malicious scripts to users.

An example attack scenario could be that an attacker will redirect many
users (by email, posting in the organization portal, etc.) to some
blocked URL and an accompanying script that will steal their
authentication cookies.

 

V. DETECTION

 

Detection of this vulnerability involves injecting some HTML tags /
scripts to a blocked URL that will be responded by the MIMESweeper with
the vulnerable page.

 

VI. WORKAROUND

 

Clearswift released a patch for this vulnerability, following the
initial contact &notification.

The patch can be obtained from:

http://www.clearswift.com/support/msw/patch_MswWeb.aspx

termed as "MIMEsweeper for Web 5.1.15 Hotfix"

 

 

VII. VENDOR RESPONSE

 

Clearswift has been informed on the 27/6/06 by e-mail to their support.

Clearswift released a fixed version of the software.

 

 

VIII. DISCLOSURE TIMELINE

 

27/06/06            Identification of the flaw

27/06/06            Reporting the flaw to clearswift by email

27/06/06            Response from clearswift, asking for more
description

27/06/06            Providing the full description to clearswift

28/06/06            Clearswift acknowledge of the vulnerability

06/07/06            Patch released by clearswift

09/07/06            Public advisory

 

 

IX. CREDITS

 

The vulnerability was discovered by Erez Metula.

 

Erez Metula, CISSP    
Application Security Department Manager

Security Software Engineer

E-Mail:  erezmetula@...ecure.co.il <mailto:erezmetula@...ecure.co.il> 

 

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060709/c0aa4bcb/attachment.html

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ