mailing list archives
RE: MIMESweeper For Web 5.X Cross Site Scripting
From: "Erez Metula" <erezmetula () 2bsecure co il>
Date: Mon, 10 Jul 2006 15:52:50 +0300
MIMESweeper For Web 5.X Cross Site Scripting
MIMESweeper For Web is a policy-based content security for web applications. It analyzes web content and blocks pages
or files that are prohibited by the organizational security policy.
For more Information please refer to:
A XSS vulnerability was discovered by Erez Metula. When accessing a URL which is not permitted the user is redirected
to an "access denied" page that is vulnerable to XSS. The page does not input validate / HTML Encode the input and
displays the data "as is".
bypassing the browser DOM restrictions.
web pages, perform phishing ,and generally can do everything to the original page.
The vulnerability can be exploited by just redirecting the client to some URL that is restricted by MIMESweeper policy
and adding the script at the end of the URL.
Using the MIMESweeper capabilities of a central gateway to spread malicious scripts to users.
An example attack scenario could be that an attacker will redirect many users (by email, posting in the organization
portal, etc.) to some blocked URL and an accompanying script that will steal their authentication cookies.
Detection of this vulnerability involves injecting some HTML tags / scripts to a blocked URL that will be responded by
the MIMESweeper with the vulnerable page.
Clearswift released a patch for this vulnerability, following the initial contact ¬ification.
The patch can be obtained from:
termed as "MIMEsweeper for Web 5.1.15 Hotfix"
VII. VENDOR RESPONSE
Clearswift has been informed on the 27/6/06 by e-mail to their support.
Clearswift released a fixed version of the software.
VIII. DISCLOSURE TIMELINE
27/06/06 Identification of the flaw
27/06/06 Reporting the flaw to clearswift by email
27/06/06 Response from clearswift, asking for more description
27/06/06 Providing the full description to clearswift
28/06/06 Clearswift acknowledge of the vulnerability
06/07/06 Patch released by clearswift
09/07/06 Public advisory
The vulnerability was discovered by Erez Metula.
Erez Metula, CISSP
Application Security Department Manager
Security Software Engineer
E-Mail: erezmetula () 2bsecure co il
- RE: MIMESweeper For Web 5.X Cross Site Scripting Erez Metula (Jul 10)