VHCSXSS.txt

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
  
SA0006  
  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
+++++ VHCS 2.x HTTP Error Cross Site Scripting +++++  
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  
  
  
PUBLISHED ON  
Nov 22, 2005  
  
  
PUBLISHED AT  
http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt  
http://moritz-naumann.com/adv/0006/vhcsxss/0006.txt.sig  
  
  
PUBLISHED BY  
Moritz Naumann IT Consulting & Services  
Hamburg, Germany  
http://moritz-naumann.com/  
  
SECURITY at MORITZ hyphon NAUMANN d0t COM  
GPG key: http://moritz-naumann.com/keys/0x277F060C.asc  
  
  
AFFECTED APPLICATION OR SERVICE  
VHCS  
http://www.vhcs.net/  
  
VHCS, the Virtual Hosting Control System, is a virtual  
hosting management application.  
  
  
  
AFFECTED VERSIONS  
Version 2.2.0 up to and including 2.4.6.2  
  
  
BACKGROUND  
Cross Site Scripting, also known as XSS or CSS, describes  
the injection of malicious content into output produced  
by a web application. A common attack vector is the  
inclusion of arbitrary client side script code into the  
applications' output. Failure to completely sanitize user  
input from malicious content causes a web application  
to be vulnerable to Cross Site Scripting.  
  
http://en.wikipedia.org/wiki/XSS  
http://www.cgisecurity.net/articles/xss-faq.shtml  
  
  
ISSUE  
VHCS is subject to a XSS vulnerability on its HTTP error  
messages. This issue is caused by lack of input sanitation  
in vhcs/gui/errordocs/index.php which returns unfiltered  
web server environment variables.  
  
Successful exploitation may allow for impersonification  
through session stealing attacks.  
  
The following URL demonstrates this issue:  
  
[vhcs_basedir]/dev/inputvalidation%3Cscript%3Ealert(window.location.hash)%3B%3C/script%3E#XSS  
  
  
WORKAROUND  
Client: Disable Javascript.  
Server: Prevent access to vulnerable file(s).  
  
  
SOLUTIONS  
Moritz Naumann IT Consulting & Services has crafted a  
unified diff patch against VHCS 2.4.6.2 which is available at  
http://moritz-naumann.com/adv/0006/vhcsxss/patch/index.php.diff  
  
VHCS developers may provide a fix in the 2.6 release. A release  
date is not currently set.  
  
  
TIMELINE  
Oct 06, 2005 Discovery  
Oct 06, 2005 Code maintainer notified  
Oct 06, 2005 Code maintainer replies  
Nov 22, 2005 Public disclosure  
  
  
REFERENCES  
N/A  
  
  
ADDITIONAL CREDIT  
N/A  
  
  
LICENSE  
Creative Commons Attribution-ShareAlike License Germany  
http://creativecommons.org/licenses/by-sa/2.0/de/  
  
  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.2 (GNU/Linux)  
  
iD8DBQFDg4l+n6GkvSd/BgwRAnhcAKCEfl0VO/XNXvL9ltSkJzWMBnsGxwCdE269  
2TBoq12ltOuH467cZqOUy1k=  
=IIUA  
-----END PGP SIGNATURE-----  
`