[24850] in bugtraq
NFuse Cross Site Scripting vulnerability
daemon@ATHENA.MIT.EDU (Eric Detoisien)
Wed Mar 27 16:13:43 2002
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Date: Wed, 27 Mar 2002 12:44:43 +0100
Message-ID: <F785777028C3E548A6B34A75A281A93501D74F@dex01001.GLOBAL.ASP>
From: "Eric Detoisien" <eric.detoisien@global-secure.fr>
To: <bugtraq@securityfocus.com>
Cc: <support@citrix.com>, <wp@citrix.com>
Content-Transfer-Encoding: 8bit
Hi,
NFuse provides several jsp (or asp) pages to make a portal.
In one this page (launch.jsp or launch.asp) it's possible to
use the method getLastError() of the TemplateParser object (in
fact this method is inherited from the WebPNObject object).
The CSS problem comes from the getLastError() method. It does not
filter the URL parameters that cause the problem.
Exemple :
if your launch.jsp contains a bit of code like this :
if (!parser.Parse())
{
out.println("Error: " + parser.getLastError());
}
else
{
...
}
With a request like this you can get the cookie with login and
password (the user must be connected before) :
http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script>
This was tested on :
NFuse 1.6 + Apache
NFuse 1.51 + Apache
NFuse 1.6 + Microsoft IIS
Workaround :
Do not print result of GetLastError() or filter the result before.
P.S. : thanks to Sylvain Bartoli and Selim Tahi who participated in testing
Eric DETOISIEN
Consultant Sécurité
GLOBAL SECURE
Web : http://www.global-secure.fr
