[26883] in bugtraq
XSS in Null HTTPd
daemon@ATHENA.MIT.EDU (Matthew Murphy)
Mon Sep 2 13:20:00 2002
Message-ID: <008e01c252a1$c846f160$e62d1c41@kc.rr.com>
From: "Matthew Murphy" <mattmurphy@kc.rr.com>
To: "VulnDiscuss" <vulndiscuss@vulnwatch.org>,
"VulnWatch" <vulnwatch@vulnwatch.org>,
"Vuln-Dev" <vuln-dev@securityfocus.com>,
"SecurITeam News" <news@securiteam.com>,
"BugTraq" <bugtraq@securityfocus.com>
Date: Mon, 2 Sep 2002 11:57:11 -0500
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Null HTTPd is a simple HTTP server that runs on Win32/Unix systems. It is
quite basic, but offers good CGI support. A vulnerability in Null HTTPd may
allow cross-site scripting via a 404 page:
http://localhost/a?x=<SCRIPT>alert(document.URL)</SCRIPT>
You have to place this in the query string so that it doesn't get the
typical "%xx..." urlencode treatment from the browser. If the code is
encoded in any way, it prevents the vulnerability from working.
"The reason the mainstream is thought
of as a stream is because it is
so shallow."
- Author Unknown
