mailing list archives
NFuse Cross Site Scripting vulnerability
From: "Eric Detoisien" <eric.detoisien () global-secure fr>
Date: Wed, 27 Mar 2002 12:44:43 +0100
NFuse provides several jsp (or asp) pages to make a portal.
In one this page (launch.jsp or launch.asp) it's possible to
use the method getLastError() of the TemplateParser object (in
fact this method is inherited from the WebPNObject object).
The CSS problem comes from the getLastError() method. It does not
filter the URL parameters that cause the problem.
if your launch.jsp contains a bit of code like this :
out.println("Error: " + parser.getLastError());
With a request like this you can get the cookie with login and
password (the user must be connected before) :
This was tested on :
NFuse 1.6 + Apache
NFuse 1.51 + Apache
NFuse 1.6 + Microsoft IIS
Do not print result of GetLastError() or filter the result before.
P.S. : thanks to Sylvain Bartoli and Selim Tahi who participated in testing
Web : http://www.global-secure.fr
- NFuse Cross Site Scripting vulnerability Eric Detoisien (Mar 27)