Caucho Technology Resin Cross-Site Scripting Vulnerability

Bugtraq ID:	2981
Class:	Input Validation Error
CVE:	CVE-2001-0828
Remote:	Yes
Local:	No
Published:	Jul 02 2001 12:00AM
Updated:	Mar 19 2015 09:23AM
Credit:	This vulnerability was submitted to BugTraq by "TAKAGI, Hiromitsu" <[email protected]> on July 2nd, 2001.
Vulnerable:	Caucho Technology Resin 1.2.2
Not Vulnerable:	Caucho Technology Resin 1.2.3 - Apache Software Foundation Apache 1.3.9 - Microsoft Windows 2000 Professional

Caucho Technology Resin Cross-Site Scripting Vulnerability

Resin is a commercial "fast" webserver which offers full JSP support.

Resin does not filter script embedding from user-submitted links that are displayed on the server's websites. A malicious webmaster can exploit this vulnerability to cause JavaScript commands or embedded scripts to be executed by any user who clicks on the hyper-link.

Caucho Technology Resin Cross-Site Scripting Vulnerability

"TAKAGI, Hiromitsu" provided these examples in his BugTraq posting:

http://Resin/<SCRIPT>alert(document.cookie)</SCRIPT>.jsp

http://www.caucho.com/<SCRIPT>document.write(document.cookie)</SCRIPT>.jsp

Caucho Technology Resin Cross-Site Scripting Vulnerability

Solution:
The vendor has patched this issue in later versions.

Caucho Technology Resin Cross-Site Scripting Vulnerability

References:

• Caucho Technology Homepage (Caucho Technology)
  
• Resin Version Updates Announcement (Caucho Technology)