WebWasher Classic Error Message Cross-Site Scripting Vulnerability

Bugtraq ID:	9039
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 13 2003 12:00AM
Updated:	Nov 13 2003 12:00AM
Credit:	The disclosure of this issue has been credited to <[email protected]>.
Vulnerable:	Webwasher Webwasher Classic 3.3 build 44 Webwasher Webwasher Classic 2.2.1
Not Vulnerable:

WebWasher Classic Error Message Cross-Site Scripting Vulnerability

It has been reported that a cross-site scripting vulnerability may exist in WebWasher Classic that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to error messages returned to the user. User-supplied data is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.

WebWasher Classic versions 3.3 Build 44 and 2.2.1 are reported to be prone to this issue, however other versions may be affected as well.

WebWasher Classic Error Message Cross-Site Scripting Vulnerability

The following proof of concept has been provided:

http://www.example.com/<script>alert("WASH_ME")</script>

WebWasher Classic Error Message Cross-Site Scripting Vulnerability

Solution:
The vendor has released Webwasher Classic version 3.4 to address this and other issues.


Webwasher Webwasher Classic 2.2.1

• WebWasher wash34.exe
  ftp://ftp.webwasher.com/pub/wwash/wash34.exe

Webwasher Webwasher Classic 3.3 build 44

• WebWasher wash34.exe
  ftp://ftp.webwasher.com/pub/wwash/wash34.exe

WebWasher Classic Error Message Cross-Site Scripting Vulnerability

References:

• Webwasher Classic Product Homepage (Webwasher)
  
• Webwasher Classic Error-Message XSS Vulnerability ("Oliver Karow" )