AOH :: HP Unsorted I :: B06-5521.HTM

iPlanet Messaging Server Messenger Express by "Sun" XSS



Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun"
Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun"




=B7= Security Advisory ==B7

Issue: Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server 
Messenger Express by "Sun"
Discovered Date: 25/09/2006
Author: Tal Argoni, LegendaryZion. [talargoni at gmail.com]
Product Vendor: http://www.sun.com/ 


Details:

iPlanet Messaging Server Messenger Express by "Sun" is prone to a Cross Site 
Scripting Vulnerability.
The vulnerability exists in filter engine, caused by the lack of Input 
Validation/Filtering
of malicious Method "Expression()" of Cascading Style Sheets (CSS).

About Cascading Style Sheets (CSS):

Cascading Style Sheets (CSS) is a stylesheet language used to describe the 
presentation
of a document written in a markup language. Its most common application is 
to style web pages written
in HTML and XHTML.
English:
http://en.wikipedia.org/wiki/Cascading_Style_Sheets 

About Expression() Method:

Receive string that specifies any valid script(JScript, JavaScript, 
VBSCript)
statement without quotations or semicolons. This string can include 
references to
other properties on the current page. Array references are not allowed on 
object
properties included in this script.



Exploitation Mail:

...
------=_NextPart_000_0006_01C6DD9E.26B2BBD0
Content-Type: text/html;


...


Successful exploitation may allow execution of script code. This could also 
be exploited
to execute malicious scripts, spoof the entire website's content, stealing 
cookies, stealing session ID,
commit Denial Of Service attacks and more...

Proof Of Concept:



google it
http://www.google.com/search?q=allintitle%3A+%22iPlanet+Messenger+Express%22 

Israels ISP using the web mail:
Netvision - http://www.netvision.net.il/ 
012 - http://www.012.net/ 

Around the globe:
The City University of New York - http://www.jjay.cuny.edu/ 
http://www.idm.net.lb/ 
https://www.utk.edu/ 




The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.