Acme thttpd CGI Test Script Cross-Site Scripting Vulnerability

Bugtraq ID:	9474
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 22 2004 12:00AM
Updated:	Jan 22 2004 12:00AM
Credit:	Discovery is credited to "Rafel Ivgi, The-Insider" <[email protected]>.
Vulnerable:	Acme thttpd 2.0.5 + FREESCO FREESCO 0.3.2 + FREESCO FREESCO 0.3.1 + FREESCO FREESCO 0.3 .0 + FREESCO FREESCO 0.2.7 Acme thttpd 2.0.4 - SuSE Linux 6.3 - SuSE Linux 6.2 Acme thttpd 2.0.3 Acme thttpd 2.0.2 Acme thttpd 2.0.1 Acme thttpd 2.0 Acme thttpd 1.95 Acme thttpd 1.90 a Acme thttpd 1.0
Not Vulnerable:

Acme thttpd CGI Test Script Cross-Site Scripting Vulnerability

thttpd is prone to a cross-site scripting vulnerability in the CGI test script. This could permit a remote attacker to create a malicious link to the web server that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks.

It should be noted that FREESCO includes an embedded version of thttpd and is also prone to this vulnerability.

Acme thttpd CGI Test Script Cross-Site Scripting Vulnerability

The following example was provided:

http://www.example.com/cgi/example?test=<script>alert('xss')</script>

Acme thttpd CGI Test Script Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Acme thttpd CGI Test Script Cross-Site Scripting Vulnerability

References:

• FREESCO Homepage (FREESCO)
  
• thttpd Homepage (Acme)
  
• FREESCO public http server - Cross Site Scripting Vulnerabillity ("Rafel Ivgi, The-Insider" )