Microsoft SharePoint 'Source' Parameter Multiple URI Open Redirection Vulnerabilities

Bugtraq ID:	49620
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 14 2011 12:00AM
Updated:	Sep 14 2011 12:00AM
Credit:	Irene Abezgauz
Vulnerable:	Microsoft SharePoint Server 2010 Standard Edition 0 Microsoft SharePoint Server 2010 Enterprise Edition 0 Microsoft SharePoint Server 2010 SP1 Microsoft SharePoint Server 2007 x64 SP2 Microsoft SharePoint Server 2007 x64 SP1 Microsoft SharePoint Server 2007 x64 0 Microsoft SharePoint Server 2007 Standard Edition 0 Microsoft SharePoint Server 2007 Enterprise Edition 0 Microsoft SharePoint Server 2007 SP2 Microsoft SharePoint Server 2007 SP1 Microsoft SharePoint Server 2007 0
Not Vulnerable:

Microsoft SharePoint 'Source' Parameter Multiple URI Open Redirection Vulnerabilities

Microsoft SharePoint is prone to multiple URI open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.

Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks.

The following products are affected;

Microsoft SharePoint 2007
Microsoft SharePoint 2010

Microsoft SharePoint 'Source' Parameter Multiple URI Open Redirection Vulnerabilities

An attacker can exploit this issue by injecting an external URI into the affected site.

The following example URI is available:

http://www.example.com/Docs/Lists/Announcements/NewForm.aspx?Source=[xss]

Microsoft SharePoint 'Source' Parameter Multiple URI Open Redirection Vulnerabilities

Solution:
Updates are available. Please see the references for more details.

Microsoft SharePoint 'Source' Parameter Multiple URI Open Redirection Vulnerabilities

References:

• Microsoft Homepage (Microsoft)
  
• Seeker Advisory Sep11: Insecure Redirect in Microsoft SharePoint Portal (Irene Abezgauz )
  
• Microsoft Security Bulletin MS11-074 - Important (Microsoft)