Home page logo
/

bugtraq logo Bugtraq mailing list archives

Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun"
From: "LegendaryZion" <moskito () smile net il>
Date: Tue, 31 Oct 2006 18:33:30 +0200


·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun"
Discovered Date: 25/09/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.sun.com/


Details:

iPlanet Messaging Server Messenger Express by "Sun" is prone to a Cross Site Scripting Vulnerability. The vulnerability exists in filter engine, caused by the lack of Input Validation/Filtering
of malicious Method "Expression()" of Cascading Style Sheets (CSS).

About Cascading Style Sheets (CSS):

Cascading Style Sheets (CSS) is a stylesheet language used to describe the presentation of a document written in a markup language. Its most common application is to style web pages written
in HTML and XHTML.
English:
http://en.wikipedia.org/wiki/Cascading_Style_Sheets

About Expression() Method:

Receive string that specifies any valid script(JScript, JavaScript, VBSCript) statement without quotations or semicolons. This string can include references to other properties on the current page. Array references are not allowed on object
properties included in this script.

<ELEMENT STYLE="AttributeName:expression(Script)">

Exploitation Mail:

...
------=_NextPart_000_0006_01C6DD9E.26B2BBD0
Content-Type: text/html;

<IMG width="0" height="0" style="width: expression(alert('expression'));">
...


Successful exploitation may allow execution of script code. This could also be exploited to execute malicious scripts, spoof the entire website's content, stealing cookies, stealing session ID,
commit Denial Of Service attacks and more...

Proof Of Concept:

<IMG style="width: expression(alert('expression'));">

google it
http://www.google.com/search?q=allintitle%3A+%22iPlanet+Messenger+Express%22

Israels ISP using the web mail:
Netvision - http://www.netvision.net.il/
012 -     http://www.012.net/

Around the globe:
The City University of New York - http://www.jjay.cuny.edu/
http://www.idm.net.lb/
https://www.utk.edu/




  By Date           By Thread  

Current thread:
  • Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun" LegendaryZion (Oct 31)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]