PostMaster Proxy Service Cross-Site Scripting Vulnerability
BID:9055
Info
PostMaster Proxy Service Cross-Site Scripting Vulnerability
| Bugtraq ID: | 9055 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 17 2003 12:00AM |
| Updated: | Nov 17 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Ziv Kamir. |
| Vulnerable: |
Woppoware PostMaster 3.17.1 Woppoware PostMaster 3.16.1 |
| Not Vulnerable: | |
Discussion
PostMaster Proxy Service Cross-Site Scripting Vulnerability
PostMaster has been reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization that is performed by the proxy service on user-supplied data. An attacker may construct a malicious HTTP request link that contains embedded HTML and script code. When this request is handled by the proxy service, the malicious HTML and script code contained in the request will be incorporated into an error page and in turn will be rendered in the browser of a user who follows the link.
PostMaster has been reported prone to a cross-site scripting vulnerability. The issue presents itself due to a lack of sufficient sanitization that is performed by the proxy service on user-supplied data. An attacker may construct a malicious HTTP request link that contains embedded HTML and script code. When this request is handled by the proxy service, the malicious HTML and script code contained in the request will be incorporated into an error page and in turn will be rendered in the browser of a user who follows the link.
Exploit / POC
PostMaster Proxy Service Cross-Site Scripting Vulnerability
The following proof of concept has been supplied:
http://www.example.com/<script>alert(document.cookie)</script>
The following proof of concept has been supplied:
http://www.example.com/<script>alert(document.cookie)</script>
Solution / Fix
PostMaster Proxy Service Cross-Site Scripting Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
PostMaster Proxy Service Cross-Site Scripting Vulnerability
References:
References:
- PostMaster Homepage (Woppoware)