Home page logo
/

bugtraq logo Bugtraq mailing list archives

NFuse Cross Site Scripting vulnerability
From: "Eric Detoisien" <eric.detoisien () global-secure fr>
Date: Wed, 27 Mar 2002 12:44:43 +0100

Hi,

NFuse provides several jsp (or asp) pages to make a portal. 
In one this page (launch.jsp or launch.asp) it's possible to
use the method getLastError() of the TemplateParser object (in
fact this method is inherited from the WebPNObject object).

The CSS problem comes from the getLastError() method. It does not
filter the URL parameters that cause the problem.

Exemple :
if your launch.jsp contains a bit of code like this :

if (!parser.Parse()) 
{
    out.println("Error: " + parser.getLastError());
}
else
{
...
}        

With a request like this you can get the cookie with login and 
password (the user must be connected before) :
http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script>

This was tested on :
NFuse 1.6 + Apache
NFuse 1.51 + Apache
NFuse 1.6 + Microsoft IIS

Workaround :
Do not print result of GetLastError() or filter the result before.


P.S. : thanks to Sylvain Bartoli and Selim Tahi who participated in testing


Eric DETOISIEN
Consultant Sécurité
GLOBAL SECURE
Web  : http://www.global-secure.fr


  By Date           By Thread  

Current thread:
  • NFuse Cross Site Scripting vulnerability Eric Detoisien (Mar 27)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]