Critical Path InJoin Directory Server Cross-Site Scripting Vulnerability
BID:4717
Info
Critical Path InJoin Directory Server Cross-Site Scripting Vulnerability
| Bugtraq ID: | 4717 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0787 |
| Remote: | Yes |
| Local: | No |
| Published: | May 10 2002 12:00AM |
| Updated: | Jul 11 2009 12:46PM |
| Credit: | Discovery of this issue is credited to Nomad Mobile Research Centre. |
| Vulnerable: |
Critical Path InJoin Directory Server 4.0 |
| Not Vulnerable: | |
Discussion
Critical Path InJoin Directory Server Cross-Site Scripting Vulnerability
Critical Path provides an LDAP (Lightweight Directory Access Protocol) Directory Server called InJoin. InJoin Directory is provided for Microsoft Windows operating systems and Unix variants.
HTML code is not filtered from URL parameters that are used as output in the web-based administrative interface. This enables an attacker to inject malicious script code into a link to the administrative interface. When this link is visited by an authenticated administrative user, the attacker's script code will be executed in the browser of that user, in the security context of the site running the interface.
Successful exploitation may allow the attacker to steal cookie-based authentication credentials from the administrative user.
Critical Path provides an LDAP (Lightweight Directory Access Protocol) Directory Server called InJoin. InJoin Directory is provided for Microsoft Windows operating systems and Unix variants.
HTML code is not filtered from URL parameters that are used as output in the web-based administrative interface. This enables an attacker to inject malicious script code into a link to the administrative interface. When this link is visited by an authenticated administrative user, the attacker's script code will be executed in the browser of that user, in the security context of the site running the interface.
Successful exploitation may allow the attacker to steal cookie-based authentication credentials from the administrative user.
Exploit / POC
Critical Path InJoin Directory Server Cross-Site Scripting Vulnerability
The following examples were provided as a proof-of-concept:
http://ip:1500/DSASD&DSA=1&LOCID=<script>^Ã?.</script>&FRAME=Y
http://ip:1500/OBCR&OC=<script>^Ã?.</script>&FRAME=Y
The following examples were provided as a proof-of-concept:
http://ip:1500/DSASD&DSA=1&LOCID=<script>^Ã?.</script>&FRAME=Y
http://ip:1500/OBCR&OC=<script>^Ã?.</script>&FRAME=Y
Solution / Fix
Critical Path InJoin Directory Server Cross-Site Scripting Vulnerability
Solution:
Critical Path has acknowledged this issue and plans a maintenance release of iCon (4.1.4.7). This release will be made available to supported customers via the support website:
http://support.cp.net
Solution:
Critical Path has acknowledged this issue and plans a maintenance release of iCon (4.1.4.7). This release will be made available to supported customers via the support website:
http://support.cp.net
References
Critical Path InJoin Directory Server Cross-Site Scripting Vulnerability
References:
References:
- Critical Path Support Page (Critical Path)