ExpressionEngine HTTP Response Splitting and Cross Site Scripting Vulnerabilities
BID:27128
Info
ExpressionEngine HTTP Response Splitting and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 27128 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-0202 CVE-2008-0201 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 03 2008 12:00AM |
| Updated: | Jul 05 2016 10:00PM |
| Credit: | MustLive is credited with discovering these issues. |
| Vulnerable: |
EllisLab ExpressionEngine 1.2.1 |
| Not Vulnerable: |
EllisLab ExpressionEngine 1.3.1 |
Discussion
ExpressionEngine HTTP Response Splitting and Cross Site Scripting Vulnerabilities
ExpressionEngine is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
ExpressionEngine 1.2.1 is vulnerable to these issues; other versions may also be affected.
ExpressionEngine is prone to an HTTP-response-splitting vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, steal cookie-based authentication credentials, and influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.
ExpressionEngine 1.2.1 is vulnerable to these issues; other versions may also be affected.
Exploit / POC
ExpressionEngine HTTP Response Splitting and Cross Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI is available:
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example URI is available:
Solution / Fix
ExpressionEngine HTTP Response Splitting and Cross Site Scripting Vulnerabilities
Solution:
The vendor released ExpressionEngine 1.3.1 to address these issues. Please contact the vendor for information on obtaining and applying the appropriate updates.
Solution:
The vendor released ExpressionEngine 1.3.1 to address these issues. Please contact the vendor for information on obtaining and applying the appropriate updates.
References
ExpressionEngine HTTP Response Splitting and Cross Site Scripting Vulnerabilities
References:
References: