[Full-disclosure] Microsoft Internet Information Services UTF-7 XSS Vulnerability [MS06-053]

2006-10-02T00:00:00
ID SECURITYVULNS:DOC:14518
Type securityvulns
Reporter Securityvulns
Modified 2006-10-02T00:00:00

Description

  • Title: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Microsoft Internet Information Services UTF-7 XSS Vulnerability [http://www.geocities.jp/ptrs_sec/advisory09e.html]

  • Date: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 October 2006

  • Author: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Eiji James Yoshida [ptrs-ejy@bp.iij4u.or.jp]

  • Risk: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Medium

  • Vulnerable: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Internet Information Services

  • Overview: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Using UTF-7 encoded URLs, IIS may return user specified content to the browser.

If 'Encoding' is set to 'Auto Select', and Internet Explorer finds a UTF-7 string in the response's body, it will set the charset encoding to UTF-7 automatically, unless a certain charset encoding is already enforced.

  • Proof of concept: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://MaliciousSite/+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-.htw?CiWebHitsFile=/iisstart.asp&CiRestriction='' http://MaliciousSite/+ADw-SCRIPT+AD4-alert('XSS');+ADw-+AC8-SCRIPT+AD4-.ida

UTF-7("<") = +ADw-, +ADx-, +ADy-, +ADz- UTF-7(">") = +AD4-, +AD5-, +AD6-, +AD7- UTF-7("/") = +AC8-, +AC9-

  • Patch: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ Microsoft Security Bulletin MS06-053 Vulnerability in Indexing Service Could Allow Cross-Site Scripting (920685) [http://www.microsoft.com/technet/security/bulletin/ms06-053.mspx]

  • Vendor status: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ IPA/ISEC was notified on the 27th December 2005. Microsoft has released a patch for this vulnerability on the 12th September 2006.

  • Similar vulnerabilities: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ XSS vulnerabilities in Google.com [http://www.watchfire.com/securityzone/advisories/12-21-05.aspx]

Microsoft Security Bulletin (MS00-084) Patch Available for 'Indexing Services Cross Site Scripting' [http://www.microsoft.com/technet/security/bulletin/ms00-084.mspx]


Eiji James Yoshida penetration technique research site E-mail: ptrs-ejy@bp.iij4u.or.jp URL: http://www.geocities.jp/ptrs_sec/index.htm



Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/