Citrix NFuse Cross-Site Scripting Vulnerability
BID:4372
Info
Citrix NFuse Cross-Site Scripting Vulnerability
| Bugtraq ID: | 4372 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0504 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 27 2002 12:00AM |
| Updated: | Jul 11 2009 11:56AM |
| Credit: | Discovery of this issue is credited to "Eric Detoisien" <[email protected]>. |
| Vulnerable: |
Citrix Nfuse 1.51 Citrix Nfuse 1.6 |
| Not Vulnerable: | |
Discussion
Citrix NFuse Cross-Site Scripting Vulnerability
Citrix NFuse is an application portal server meant to provide the functionality of any application on the server via a web browser. NFuse works in conjunction with a previously-installed webserver. NFuse is said to support almost any operating system, including Unix and Linux variants, as well as Microsoft Windows operating systems.
A cross-site scripting vulnerability exists in Citrix NFuse. The launch.asp and launch.jsp scripts do not filter script code from URL parameters. An attacker may create a malicious link to one of these scripts which includes script code, which will be executed in the browser of an arbitrary web user who visits the link, in the security context of the site running Citrix NFuse.
This may enable an attacker to steal cookie-based authentication credentials from legitimate users of the vulnerable software.
Citrix NFuse is an application portal server meant to provide the functionality of any application on the server via a web browser. NFuse works in conjunction with a previously-installed webserver. NFuse is said to support almost any operating system, including Unix and Linux variants, as well as Microsoft Windows operating systems.
A cross-site scripting vulnerability exists in Citrix NFuse. The launch.asp and launch.jsp scripts do not filter script code from URL parameters. An attacker may create a malicious link to one of these scripts which includes script code, which will be executed in the browser of an arbitrary web user who visits the link, in the security context of the site running Citrix NFuse.
This may enable an attacker to steal cookie-based authentication credentials from legitimate users of the vulnerable software.
Exploit / POC
Citrix NFuse Cross-Site Scripting Vulnerability
The following example was submitted:
http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script>
The following example was submitted:
http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script>
Solution / Fix
Citrix NFuse Cross-Site Scripting Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.