RSA ClearTrust Login Page Cross Site Scripting Vulnerability

Bugtraq ID:	7108
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 15 2003 12:00AM
Updated:	Mar 15 2003 12:00AM
Credit:	Discovery of this vulnerability is credited to [email protected].
Vulnerable:	Rsa Cleartrust Servers 4.7.1 Rsa Cleartrust Servers 4.6.1 .1
Not Vulnerable:

RSA ClearTrust Login Page Cross Site Scripting Vulnerability

A cross-site scripting vulnerability has been discovered in ClearTrust. Specifically, the login page for the management application is not properly sanitized of some user-supplied values.

An attacker can exploit this vulnerability by creating a specially crafted URL that includes malicious HTML code for the login page used by ClearTrust.

RSA ClearTrust Login Page Cross Site Scripting Vulnerability

The following proof of concepts were provided:

https://victim.com/cleartrust/ct_logon.asp?CTLoginErrorMsg=<script>alert(1)
</script>

https://victim.com/cleartrust/ct_logon.asp?CTAuthMode=BASIC&CTLoginErrorMsg=
xx&ct_orig_uri=">< script>alert(1)/script><"

RSA ClearTrust Login Page Cross Site Scripting Vulnerability

References:

• ClearTrust (RSA Security)
  
• RSA Homepage (RSA Security)
  
• @(#)Mordred Security Labs - RSA ClearTrust Cross Site Scripting issues ([email protected])