Caucho Resin Multiple HTML Injection and Cross-site Scripting Vulnerabilities
BID:8852
Info
Caucho Resin Multiple HTML Injection and Cross-site Scripting Vulnerabilities
| Bugtraq ID: | 8852 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 20 2003 12:00AM |
| Updated: | Oct 20 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to Donnie Werner<[email protected]>. |
| Vulnerable: |
Caucho Technology Resin 2.1.2 Caucho Technology Resin 2.1.1 Caucho Technology Resin 2.1 .s020711 Caucho Technology Resin 2.0 b2 Caucho Technology Resin 2.0 |
| Not Vulnerable: | |
Discussion
Caucho Resin Multiple HTML Injection and Cross-site Scripting Vulnerabilities
It has been reported that Caucho Resin is prone to multiple HTML Injection and cross-site scripting vulnerabilities in various scripts that may allow a remote attacker to cause hostile HTML or script code to be rendered in the browser of a user who follows a malicious link supplied by the attacker.
The affected scripts include env.jsp, form.jsp, session.jsp, and tictactoe.jsp. The 'name' and 'comment' fields of guestbook.jsp have been reported to be vulnerable to HTML injection. An attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of an unsuspecting user. Exploitation may also allow attackers to inject hostile HTML and script code into the sample guestbook.
Successful exploitation of these issues may allow an attacker to steal cookie-based credentials. Other attacks may also be possible.
Caucho Resin version 2.1 and prior have been reported to be prone to this issue, however other versions may be affected as well.
It has been reported that Caucho Resin is prone to multiple HTML Injection and cross-site scripting vulnerabilities in various scripts that may allow a remote attacker to cause hostile HTML or script code to be rendered in the browser of a user who follows a malicious link supplied by the attacker.
The affected scripts include env.jsp, form.jsp, session.jsp, and tictactoe.jsp. The 'name' and 'comment' fields of guestbook.jsp have been reported to be vulnerable to HTML injection. An attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of an unsuspecting user. Exploitation may also allow attackers to inject hostile HTML and script code into the sample guestbook.
Successful exploitation of these issues may allow an attacker to steal cookie-based credentials. Other attacks may also be possible.
Caucho Resin version 2.1 and prior have been reported to be prone to this issue, however other versions may be affected as well.
Exploit / POC
Solution / Fix
References
Caucho Resin Multiple HTML Injection and Cross-site Scripting Vulnerabilities
References:
References:
- Caucho Technology Homepage (Caucho Technology)