Websense Blocked Sites XSS

[Mr. P.Taylor]

Websense Blocked Sites XSS

Risk: High

Product: Websense Enterprise v4.3.0 - v5.1 (Maybe others we only
tested this version)

Product URL: http://www.websense.com

Found By: PeterT - petert@imagine-sw.com

Problem:
When Websense blocks a web site, it returns a web page to the browser
stating
that the site has been blocked. This error message contains the URL which
was
requested. Websense does not do any validation or encoding of the URL before
returning it in the error message. This allows an attacker to supply a URL
that
contains script <JavaScript, ActiveX, VB). This script will run in the
context
of a server in the trusted domain and combined with other IE flaws can have
serious consequences.

We have marked this as a High risk because we believe that allowing
attackers
to run arbitrary programs on your desktop at will, is a serious problem.


Proof of Concept:
A URL like
http://BlockedSite?<SCRIPT>alert('hello')</SCRIPT> will run script.

Resolution:
The vendor has come out with a patch. Notified on Nov 29, 2003.

Thanks to Websense for fixing this issue.

Disclaimer:
Standard disclaimer applies. The opinions expressed in this advisory are
our own and not of any company. The information within this advisory may
change without notice. Use of this information constitutes acceptance for
use in an AS IS condition. There are no warranties with regard to this
information. In no event shall the author be liable for any damages
whatsoever arising out of or in connection with the use or spread of this
information. Any use of this information is at the user's own risk.

[3APA3A]

Dear Mr. P.Taylor,

It runs error message in context of blocked site. Now lets try to find
out possible impacts:

1. It's possible to run javascript on the user host in context of
blocked site. But it's most likely blocked site is not in list of
trusted web sites on user's host, so it's impossible to get something
different from running same script on another webpage.

2. It possible to steal cookie, submit some forms, etc, on blocked site.
But site is blocked. So, it's impossible to steal something or submit
something to this site.

Conclusion: there is no security impact

Post Conclusion: Guys, it's perfect you can find all these XSS/CSS bugs
in John Doe's guest books, Read-Doc-from-CDRom servers, etc. But please
think about _security_ impact before submitting this to _security_
related lists.

--Wednesday, December 3, 2003, 7:35:39 PM, you wrote to dhubbard@websense.com:


MPT> Websense Blocked Sites XSS

MPT> Risk: High

MPT> Product: Websense Enterprise v4.3.0 - v5.1 (Maybe others we only
MPT> tested this version)

MPT> Product URL: http://www.websense.com

MPT> Found By: PeterT - petert@imagine-sw.com

MPT> Problem:
MPT> When Websense blocks a web site, it returns a web page to the browser
MPT> stating
MPT> that the site has been blocked. This error message contains the URL which
MPT> was
MPT> requested. Websense does not do any validation or encoding of the URL before
MPT> returning it in the error message. This allows an attacker to supply a URL
MPT> that
MPT> contains script <JavaScript, ActiveX, VB). This script will run in the
MPT> context
MPT> of a server in the trusted domain and combined with other IE flaws can have
MPT> serious consequences.

MPT> We have marked this as a High risk because we believe that allowing
MPT> attackers
MPT> to run arbitrary programs on your desktop at will, is a serious problem.


MPT> Proof of Concept:
MPT> A URL like
MPT> http://BlockedSite?<SCRIPT>alert('hello')</SCRIPT> will run script.

MPT> Resolution:
MPT> The vendor has come out with a patch. Notified on Nov 29, 2003.

MPT> Thanks to Websense for fixing this issue.

MPT> Disclaimer:
MPT> Standard disclaimer applies. The opinions expressed in this advisory are
MPT> our own and not of any company. The information within this advisory may
MPT> change without notice. Use of this information constitutes acceptance for
MPT> use in an AS IS condition. There are no warranties with regard to this
MPT> information. In no event shall the author be liable for any damages
MPT> whatsoever arising out of or in connection with the use or spread of this
MPT> information. Any use of this information is at the user's own risk.



--
~/ZARAZA
Èáî ôàêòû åñòü ôàêòû, è èçëîæåíû îíè ëèøü äëÿ òîãî, ÷òîáû èõ ïîíÿëè è â íèõ ïîâåðèëè. (Òâåí)

[Greg Meehan]

FYI: You can use a customized block page in /custom that does not =
display
the URL, such as creating a "Sorry, This URL is Blocked" page with your
company's logo. Heck, you can also just edit the "master.html" block =
page in
the /default dir to remove the URL displayed field.

-Greg

-----Original Message-----
From: 3APA3A [mailto:3APA3A@SECURITY.NNOV.RU]
Sent: Friday, December 05, 2003 7:09 AM
To: Mr. P.Taylor
Cc: aleph1@securityfocus.com; bugtraq@securityfocus.com
Subject: Re: Websense Blocked Sites XSS


Dear Mr. P.Taylor,

It runs error message in context of blocked site. Now lets try to =
find
out possible impacts:

1. It's possible to run javascript on the user host in context =
of
blocked site. But it's most likely blocked site is not in list =
of
trusted web sites on user's host, so it's impossible to get =
something
different from running same script on another webpage.

2. It possible to steal cookie, submit some forms, etc, on blocked =
site.
But site is blocked. So, it's impossible to steal something or =
submit
something to this site.

Conclusion: there is no security impact

Post Conclusion: Guys, it's perfect you can find all these XSS/CSS =
bugs
in John Doe's guest books, Read-Doc-from-CDRom servers, etc. But =
please
think about _security_ impact before submitting this to =
_security_
related lists.

--Wednesday, December 3, 2003, 7:35:39 PM, you wrote to
dhubbard@websense.com:


MPT> Websense Blocked Sites XSS

MPT> Risk: High

MPT> Product: Websense Enterprise v4.3.0 - v5.1 (Maybe others we only
MPT> tested this version)

MPT> Product URL: http://www.websense.com

MPT> Found By: PeterT - petert@imagine-sw.com

MPT> Problem:
MPT> When Websense blocks a web site, it returns a web page to the =
browser
MPT> stating
MPT> that the site has been blocked. This error message contains the =
URL
which
MPT> was
MPT> requested. Websense does not do any validation or encoding of the =
URL
before
MPT> returning it in the error message. This allows an attacker to =
supply a
URL
MPT> that
MPT> contains script <JavaScript, ActiveX, VB). This script will run in =
the
MPT> context
MPT> of a server in the trusted domain and combined with other IE flaws =
can
have
MPT> serious consequences.

MPT> We have marked this as a High risk because we believe that =
allowing
MPT> attackers
MPT> to run arbitrary programs on your desktop at will, is a serious
problem.


MPT> Proof of Concept:
MPT> A URL like
MPT> http://BlockedSite?<SCRIPT>alert('hello')</SCRIPT> will run =
script.

MPT> Resolution:
MPT> The vendor has come out with a patch. Notified on Nov 29, 2003.

MPT> Thanks to Websense for fixing this issue.

MPT> Disclaimer:
MPT> Standard disclaimer applies. The opinions expressed in this =
advisory
are
MPT> our own and not of any company. The information within this =
advisory
may
MPT> change without notice. Use of this information constitutes =
acceptance
for
MPT> use in an AS IS condition. There are no warranties with regard to =
this
MPT> information. In no event shall the author be liable for any =
damages
MPT> whatsoever arising out of or in connection with the use or spread =
of
this
MPT> information. Any use of this information is at the user's own =
risk.



--=20
~/ZARAZA
=C8=E1=EE =F4=E0=EA=F2=FB =E5=F1=F2=FC =F4=E0=EA=F2=FB, =E8 =
=E8=E7=EB=EE=E6=E5=ED=FB =EE=ED=E8 =EB=E8=F8=FC =E4=EB=FF =F2=EE=E3=EE, =
=F7=F2=EE=E1=FB =E8=F5 =EF=EE=ED=FF=EB=E8 =E8 =E2 =ED=E8=F5
=EF=EE=E2=E5=F0=E8=EB=E8. (=D2=E2=E5=ED)

[Eric \MightyE\ Stevens]

Some sites become accidentally blocked, or become blocked after they had
been previously available, and so there is a concern over cookie theft
here. Simply because you can't take advantage of this from within that
network at that time, doesn't prevent you from taking that information
elsewhere, or waiting until a more opportune time (such as when the site
becomes unblocked).

Although this is a fairly minimal security impact (especially given a
wide variety of other approaches to stealing cookies), I wouldn't say
that there is no security impact.

-Eric "MightyE" Stevens
http://lotgd.net

3APA3A wrote:

>Dear Mr. P.Taylor,
>
>It runs error message in context of blocked site. Now lets try to find
>out possible impacts:
>
>1. It's possible to run javascript on the user host in context of
>blocked site. But it's most likely blocked site is not in list of
>trusted web sites on user's host, so it's impossible to get something
>different from running same script on another webpage.
>
>2. It possible to steal cookie, submit some forms, etc, on blocked site.
>But site is blocked. So, it's impossible to steal something or submit
>something to this site.
>
>Conclusion: there is no security impact
>
>Post Conclusion: Guys, it's perfect you can find all these XSS/CSS bugs
>in John Doe's guest books, Read-Doc-from-CDRom servers, etc. But please
>think about _security_ impact before submitting this to _security_
>related lists.
>
>--Wednesday, December 3, 2003, 7:35:39 PM, you wrote to dhubbard@websense.com:
>
>
>MPT> Websense Blocked Sites XSS
>
>MPT> Risk: High
>
>MPT> Product: Websense Enterprise v4.3.0 - v5.1 (Maybe others we only
>MPT> tested this version)
>
>MPT> Product URL: http://www.websense.com
>
>MPT> Found By: PeterT - petert@imagine-sw.com
>
>MPT> Problem:
>MPT> When Websense blocks a web site, it returns a web page to the browser
>MPT> stating
>MPT> that the site has been blocked. This error message contains the URL which
>MPT> was
>MPT> requested. Websense does not do any validation or encoding of the URL before
>MPT> returning it in the error message. This allows an attacker to supply a URL
>MPT> that
>MPT> contains script <JavaScript, ActiveX, VB). This script will run in the
>MPT> context
>MPT> of a server in the trusted domain and combined with other IE flaws can have
>MPT> serious consequences.
>
>MPT> We have marked this as a High risk because we believe that allowing
>MPT> attackers
>MPT> to run arbitrary programs on your desktop at will, is a serious problem.
>
>
>MPT> Proof of Concept:
>MPT> A URL like
>MPT> http://BlockedSite?<SCRIPT>alert('hello')</SCRIPT> will run script.
>
>MPT> Resolution:
>MPT> The vendor has come out with a patch. Notified on Nov 29, 2003.
>
>MPT> Thanks to Websense for fixing this issue.
>
>MPT> Disclaimer:
>MPT> Standard disclaimer applies. The opinions expressed in this advisory are
>MPT> our own and not of any company. The information within this advisory may
>MPT> change without notice. Use of this information constitutes acceptance for
>MPT> use in an AS IS condition. There are no warranties with regard to this
>MPT> information. In no event shall the author be liable for any damages
>MPT> whatsoever arising out of or in connection with the use or spread of this
>MPT> information. Any use of this information is at the user's own risk.
>
>
>
>
>