Google Mini Search Appliance IE Parameter Cross-Site Scripting Vulnerability

Bugtraq ID:	25894
Class:	Input Validation Error
CVE:	CVE-2007-5255
Remote:	Yes
Local:	No
Published:	Sep 20 2007 12:00AM
Updated:	May 07 2015 05:35PM
Credit:	Websecurity discovered this vulnerability.
Vulnerable:	Google Google Mini Search Appliance 3.4.14
Not Vulnerable:

Google Mini Search Appliance IE Parameter Cross-Site Scripting Vulnerability

Google Mini Search Appliance is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Google Mini Search Appliance 3.4.14; other versions may also be affected.

Google Mini Search Appliance IE Parameter Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

The following proof-of-concept URI is available:

http://www.example.com/search?ie=[ Evil Code ]&site=x&output=xml_no_dtd'&client=x&proxystylesheet=x'

Google Mini Search Appliance IE Parameter Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google Mini Search Appliance IE Parameter Cross-Site Scripting Vulnerability

References:

• Google Mini Search Appliance Home Page (Google)
  
• Websecurity Google Mini Search Appliance (Websecurity)