IBM WebSphere Faultactor Cross-Site Scripting Vulnerability
BID:21018
CVE-2006-2431 |Info
IBM WebSphere Faultactor Cross-Site Scripting Vulnerability
| Bugtraq ID: | 21018 |
| Class: | Input Validation Error |
| CVE: |
CVE-2006-2431 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 13 2006 12:00AM |
| Updated: | Dec 18 2007 08:06PM |
| Credit: | Nuri Fattah of ProCheckUp Ltd. is credited with the discovery of this vulnerability. |
| Vulnerable: |
IBM Websphere Application Server 6.0 |
| Not Vulnerable: | |
Discussion
IBM WebSphere Faultactor Cross-Site Scripting Vulnerability
IBM WebSphere is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
WebSphere Application Server 6 is vulnerable; other versions may also be affected.
IBM WebSphere is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
WebSphere Application Server 6 is vulnerable; other versions may also be affected.
Exploit / POC
IBM WebSphere Faultactor Cross-Site Scripting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following proof of concept is available:
GET /<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> HTTP/1.1
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following proof of concept is available:
GET /<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> HTTP/1.1
Solution / Fix
IBM WebSphere Faultactor Cross-Site Scripting Vulnerability
Solution:
The vendor has released a patch that addresses this issue. Please see the vendor references for additional information.
Solution:
The vendor has released a patch that addresses this issue. Please see the vendor references for additional information.
References
IBM WebSphere Faultactor Cross-Site Scripting Vulnerability
References:
References:
- 5.0.2.16: WebSphere Application Server 5.0.2 Cumulative Fix 16 for AIX (IBM)
- 5.1.1.10: WebSphere Application Server V5.1.1 Cumulative Fix 10 for AIX (IBM)
- 6.0.2.9: WebSphere Application Server V6.0.2 Fix Pack 9 for AIX platforms (IBM)
- IBM WebSphere Application Server Cross Site Scripting (Securiteam)
- IBM Websphere Homepage (IBM)
- PR05-04: Cross Site Scripting (XSS) Vulnerability in IBM WebSphere Application S (ProCheckUp)