Onderwerp: VHCS 2.x HTTP Error Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


SA0006

++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++
+++++ VHCS 2.x HTTP Error Cross Site Scripting +++++
++++++++++++++++++++++++++++++++++++++++++++++++++ +++++++++++


PUBLISHED ON
Nov 22, 2005


PUBLISHED AT
http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt
http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt.sig


PUBLISHED BY
Moritz Naumann IT Consulting & Services
Hamburg, Germany
http://moritz-naumann.com/

SECURITY at MORITZ hyphon NAUMANN d0t COM
GPG key: http://moritz-naumann.com/keys/0x277F060C.asc


AFFECTED APPLICATION OR SERVICE
VHCS
http://www.vhcs.net/

VHCS, the Virtual Hosting Control System, is a virtual
hosting management application.



AFFECTED VERSIONS
Version 2.2.0 up to and including 2.4.6.2


BACKGROUND
Cross Site Scripting, also known as XSS or CSS, describes
the injection of malicious content into output produced
by a web application. A common attack vector is the
inclusion of arbitrary client side script code into the
applications' output. Failure to completely sanitize user
input from malicious content causes a web application
to be vulnerable to Cross Site Scripting.

http://en.wikipedia.org/wiki/XSS
http://www.cgisecurity.net/articles/xss-faq.shtml


ISSUE
VHCS is subject to a XSS vulnerability on its HTTP error
messages. This issue is caused by lack of input sanitation
in vhcs/gui/errordocs/index.php which returns unfiltered
web server environment variables.

Successful exploitation may allow for impersonification
through session stealing attacks.

The following URL demonstrates this issue:

[vhcs_basedir]/dev/inputvalidation%3Cscript%3Ealert(window.location.h ash)%3B%3C/script%3E#XSS


WORKAROUND
Client: Disable Javascript.
Server: Prevent access to vulnerable file(s).


SOLUTIONS
Moritz Naumann IT Consulting & Services has crafted a
unified diff patch against VHCS 2.4.6.2 which is available at
http://moritz-naumann.com/adv/0006/v...index.php.diff

VHCS developers may provide a fix in the 2.6 release. A release
date is not currently set.


TIMELINE
Oct 06, 2005 Discovery
Oct 06, 2005 Code maintainer notified
Oct 06, 2005 Code maintainer replies
Nov 22, 2005 Public disclosure


REFERENCES
N/A


ADDITIONAL CREDIT
N/A


LICENSE
Creative Commons Attribution-ShareAlike License Germany
http://creativecommons.org/licenses/by-sa/2.0/de/



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDg4l+n6GkvSd/BgwRAnhcAKCEfl0VO/XNXvL9ltSkJzWMBnsGxwCdE269
2TBoq12ltOuH467cZqOUy1k=
=IIUA
-----END PGP SIGNATURE-----

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Moritz Naumann schrieb:

> SOLUTIONS
> Moritz Naumann IT Consulting & Services has crafted a
> unified diff patch against VHCS 2.4.6.2 which is available at
> http://moritz-naumann.com/adv/0006/v...index.php.diff

The patch had been lost during an upgrade, but has since been restored.

Moritz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDhTcTn6GkvSd/BgwRAhZBAKCRdciTYrOxAy+SyAz23EWyGpRM3QCeJ6HI
PCQ5K5TsnyD3hoQ2nSBnUSE=
=eKMC
-----END PGP SIGNATURE-----