·= Security Advisory =·
Issue: Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server
Messenger Express by "Sun"Discovered Date: 25/09/2006Author: Tal Argoni,
LegendaryZion. [talargoni at gmail.com]Product Vendor: http://www.sun.com/
Details:
iPlanet Messaging Server Messenger Express by "Sun" is prone to a Cross Site
Scripting Vulnerability.The vulnerability exists in filter engine, caused by
the lack of Input Validation/Filteringof malicious Method "Expression()" of
Cascading Style Sheets (CSS).
About Cascading Style Sheets (CSS):
Cascading Style Sheets (CSS) is a stylesheet language used to describe the
presentationof a document written in a markup language. Its most common
application is to style web pages writtenin HTML and
XHTML.English:http://en.wikipedia.org/wiki/Cascading_Style_Sheets
About Expression() Method:
Receive string that specifies any valid script(JScript, JavaScript,
VBSCript)statement without quotations or semicolons. This string can include
references toother properties on the current page. Array references are not
allowed on objectproperties included in this script.
<ELEMENT STYLE="AttributeName:expression(Script)">
Exploitation Mail:
...------=_NextPart_000_0006_01C6DD9E.26B2BBD0Content-Type: text/html;
<IMG width="0" height="0" style="width: expression(alert('expression'));">...
Successful exploitation may allow execution of script code. This could also be
exploitedto execute malicious scripts, spoof the entire website's content,
stealing cookies, stealing session ID,commit Denial Of Service attacks and
more...
Proof Of Concept:
<IMG style="width: expression(alert('expression'));">
google
ithttp://www.google.com/search?q=allintitle%3A+%22iPlanet+Messenger+Express%22
Israels ISP using the web mail:Netvision - http://www.netvision.net.il/012 -
http://www.012.net/
Around the globe:The City University of New York -
http://www.jjay.cuny.edu/http://www.idm.net.lb/https://www.utk.edu/
_______________________________________________Full-Disclosure - We believe in
it.Charter: http://lists.grok.org.uk/full-disclosure-charter.htmlHosted and
sponsored by Secunia - http://secunia.com/
