-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
SA0006
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++ VHCS 2.x HTTP Error Cross Site Scripting +++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PUBLISHED ON
Nov 22, 2005
PUBLISHED AT
http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt
http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt.sig
PUBLISHED BY
Moritz Naumann IT Consulting & Services
Hamburg, Germany
http://moritz-naumann.com/
SECURITY at MORITZ hyphon NAUMANN d0t COM
GPG key: http://moritz-naumann.com/keys/0x277F060C.asc
AFFECTED APPLICATION OR SERVICE
VHCS
http://www.vhcs.net/
VHCS, the Virtual Hosting Control System, is a virtual
hosting management application.
AFFECTED VERSIONS
Version 2.2.0 up to and including 2.4.6.2
BACKGROUND
Cross Site Scripting, also known as XSS or CSS, describes
the injection of malicious content into output produced
by a web application. A common attack vector is the
inclusion of arbitrary client side script code into the
applications' output. Failure to completely sanitize user
input from malicious content causes a web application
to be vulnerable to Cross Site Scripting.
http://en.wikipedia.org/wiki/XSS
http://www.cgisecurity.net/articles/xss-faq.shtml
ISSUE
VHCS is subject to a XSS vulnerability on its HTTP error
messages. This issue is caused by lack of input sanitation
in vhcs/gui/errordocs/index.php which returns unfiltered
web server environment variables.
Successful exploitation may allow for impersonification
through session stealing attacks.
The following URL demonstrates this issue:
[vhcs_basedir]/dev/inputvalidation%3Cscript%3Ealert(window.location.hash)%3B%3C/script%3E#XSS
WORKAROUND
Client: Disable Javascript.
Server: Prevent access to vulnerable file(s).
SOLUTIONS
Moritz Naumann IT Consulting & Services has crafted a
unified diff patch against VHCS 2.4.6.2 which is available at
http://moritz-naumann.com/adv/0006/vhcsxss/patch/index.php.diff
VHCS developers may provide a fix in the 2.6 release. A release
date is not currently set.
TIMELINE
Oct 06, 2005 Discovery
Oct 06, 2005 Code maintainer notified
Oct 06, 2005 Code maintainer replies
Nov 22, 2005 Public disclosure
REFERENCES
N/A
ADDITIONAL CREDIT
N/A
LICENSE
Creative Commons Attribution-ShareAlike License Germany
http://creativecommons.org/licenses/by-sa/2.0/de/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDg4l+n6GkvSd/BgwRAnhcAKCEfl0VO/XNXvL9ltSkJzWMBnsGxwCdE269
2TBoq12ltOuH467cZqOUy1k=
=IIUA
-----END PGP SIGNATURE-----
