Hi! This is the ezmlm program. I'm managing the
bugtraq@securityfocus.com mailing list.

I'm working for my owner, who can be reached
at bugtraq-owner@securityfocus.com.

Messages to you from the bugtraq mailing list seem to
have been bouncing. I've attached a copy of the first bounce
message I received.

If this message bounces too, I will send you a probe. If the probe bounces,
I will remove your address from the bugtraq mailing list,
without further notice.

I've kept a list of which messages from the bugtraq mailing list have
bounced from your address.

Copies of these messages may be in the archive.

To retrieve a set of messages 123-145 (a maximum of 100 per request),
send an empty message to:
<bugtraq-get.123_145@securityfocus.com>

To receive a subject and author list for the last 100 or so messages,
send an empty message to:
<bugtraq-index@securityfocus.com>

Here are the message numbers:

15654
15651
15657
15615
--- Enclosed is a copy of the bounce message I received.
Return-Path: <>
Received: (qmail 31069 invoked from network); 22 Aug 2004 14:43:16 -0000
Received: from mail2.securityfocus.com (205.206.231.1)
by lists2.securityfocus.com with SMTP; 22 Aug 2004 14:43:16 -0000
Received: (qmail 4596 invoked by alias); 22 Aug 2004 20:48:27 -0000
Received: (qmail 3507 invoked from network); 22 Aug 2004 20:47:28 -0000
Received: from outgoing.securityfocus.com (HELO outgoing3.securityfocus.com) (205.206.231.27)
by mail2.securityfocus.com with SMTP; 22 Aug 2004 20:47:28 -0000
Received: by outgoing3.securityfocus.com (Postfix)
id 0E2DD236F36; Sun, 22 Aug 2004 14:48:02 -0600 (MDT)
Date: Sun, 22 Aug 2004 14:48:02 -0600 (MDT)
From: MAILER-DAEMON@securityfocus.com (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: bugtraq-return-15654-bugtraq=freebsd.csie.nctu.edu.tw@securityfocus.com
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="935FE23806F.1093207561/outgoing3.securityfocus.com"
Content-Transfer-Encoding: 8bit
Message-Id: <20040822204802.0E2DD236F36@outgoing3.securityfocu s.com>

This is a MIME-encapsulated message.

--935FE23806F.1093207561/outgoing3.securityfocus.com
Content-Description: Notification
Content-Type: text/plain

This is the Postfix program at host outgoing3.securityfocus.com.

I'm sorry to have to inform you that the message returned
below could not be delivered to one or more destinations.

For further assistance, please send mail to <postmaster>

If you do so, please include this problem report. You can
delete your own text from the message returned below.

The Postfix program

<bugtraq@freebsd.csie.nctu.edu.tw>: host sunrise.gigx.net[203.204.205.206]
said: 550 5.7.1 <bugtraq@freebsd.csie.nctu.edu.tw>... Relaying denied (in
reply to RCPT TO command)

--935FE23806F.1093207561/outgoing3.securityfocus.com
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; outgoing3.securityfocus.com
X-Postfix-Queue-ID: 935FE23806F
X-Postfix-Sender: rfc822; bugtraq-return-15654@securityfocus.com
Arrival-Date: Fri, 20 Aug 2004 13:15:50 -0600 (MDT)

Final-Recipient: rfc822; bugtraq@freebsd.csie.nctu.edu.tw
Action: failed
Status: 4.0.0
Diagnostic-Code: X-Postfix; host sunrise.gigx.net[203.204.205.206] said: 550
5.7.1 <bugtraq@freebsd.csie.nctu.edu.tw>... Relaying denied (in reply to
RCPT TO command)

--935FE23806F.1093207561/outgoing3.securityfocus.com
Content-Description: Undelivered Message
Content-Type: message/rfc822
Content-Transfer-Encoding: 8bit

Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 935FE23806F; Fri, 20 Aug 2004 13:15:50 -0600 (MDT)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 20789 invoked from network); 20 Aug 2004 12:55:21 -0000
Date: 20 Aug 2004 19:25:29 -0000
Message-ID: <20040820192529.10833.qmail@www.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: Audun Larsen <larsen@xqus.com>
To: bugtraq@securityfocus.com
Subject: Cross-Site Scripting (XSS) in Nihuo Web Log Analyzer



---------------------------------------------------------------------------
Cross-Site Scripting (XSS) in Nihuo Web Log Analyzer
---------------------------------------------------------------------------
Author: Audun Larsen (larsen at xqus dot com)
Date: Aug 20, 2004


Affected software:
==================
Name: Nihuo Web Log Analyzer
URL: http://www.loganalyzer.net/index.html
Version: v1.6 (older versions not tested)
Released: Feb 17, 2004


Vendors description:
====================
Nihuo Web Log Analyzer can generate a wide range of reports and statistics from your log file - more than 80 different reports with 2D and 3D graphs.


Introduction:
=============
Most developers know that input validation is important. If you look at the history of PHP-nuke you can see that software that does not check the user
input thoroughly, is insecure.


Discussion:
===========
Many think that http access-log analyzers don't get any input from the user.
But think about it, both the user-agent and the referer header is data that can be manipulated by the user.
Nihuo Web Log Analyzer is vulnerable to just this type of attack.


Exploit:
========
To exploit Nihuo Web Log Analyzer we have to send a special HTTP request that includes malicious code.

GET / HTTP/1.1
Host: sample.com
Connection: close
Accept: text/plain
Accept-Language: en-us,en
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
User-Agent: Some-Fake-UA <img src='http://attacker.host.com/app.gif'>

Generating this HTTP request can easily be done in Perl, PHP or any other language. Generating enough hits with this user-agent will cause the user-agent to appear in the "Top Browsers" list, with the HTML code
included. Notice that single quotes is used in the User-Agent.


Tested with:
============
Apache 1.3.x
Nihuo Web Log Analyzer v1.6 (Running on Win2k)


Solution:
=========
No solution available at the time writing.
Vendor notified Aug 20, 2004.


Disclaimer:
===========
The information in this advisory and any of its demonstrations is provided "as is" without warranty of any kind.

Copyright © 2004 Audun Larsen

--935FE23806F.1093207561/outgoing3.securityfocus.com--