Citrix Metaframe XP Cross-site Scripting Vulnerability

Bugtraq ID:	8939
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 31 2003 12:00AM
Updated:	Oct 31 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to Andy Davis.
Vulnerable:	Citrix MetaFrame XP - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional
Not Vulnerable:

Citrix Metaframe XP Cross-site Scripting Vulnerability

Citrix Metaframe XP is prone to cross-site scripting attacks when returning error messages to users. The error message is generated when invalid authentication credentials are transmitted to the log-in page. Exploitation of this issue could potentially result in the theft of cookie-based authentication credentials, or other attacks.

Citrix Metaframe XP Cross-site Scripting Vulnerability

The following proof of concept has been provided.

https://www.example.com/citrix/metaframexp/default/login.asp?NFuse_LogoutId=On&NFuse_
MessageType=Error&NFuse_Message=<SCRIPT>alert("Vulnerable to XSS")</SCRIPT>

Citrix Metaframe XP Cross-site Scripting Vulnerability

Solution:
It has been reported that Citrix has addressed this issue in the latest Metaframe update, which is said to be available from the following URL. This has not been verified by Symantec.

http://www.mycitrix.com

Citrix Metaframe XP Cross-site Scripting Vulnerability

References:

• IRM 008: Citrix Metaframe XP is vulnerable to Cross Site Scripting ("IRM Advisories" )