Network Query Tool Input Validation Flaw in 'portNum' Lets Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1009932
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Apr 24 2004
|
Impact: Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): 1.6
|
Description: An input validation vulnerability was reported in Network Query Tool (NQT). A remote user can determine the installation path. A remote user can conduct cross-site scripting attacks.
Janek Vind "waraxe" reported that the software does not validate user-supplied input in the 'portNum' variable. A remote user can
create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target
user's browser. The code will originate from the site running the Network Query Tool software and will run in the security context
of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any,
associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
A demonstration exploit URL is provided:
http://localhost/nqt.php?target=foobar.com&queryType=all&portNum=foobar[xss
code here]
It is also reported that a remote user can supply an invalid value for the 'portNum' variable to cause the system
to display the installation path. A demonstration exploit URL is provided:
http://localhost/nqt.php?target=foobar.com&queryType=all&portNum=foobar
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
NQT software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as
the target user.
A remote user can determine the installation path.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.shat.net/php/nqt/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (Any)
|
Reported By: Janek Vind <come2waraxe@yahoo.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 24 Apr 2004 01:20:02 -0000
From: Janek Vind <come2waraxe@yahoo.com>
Subject: [waraxe-2004-SA#024 - XSS and full path disclosure in Network
|
{================================================================================}
{ [waraxe-2004-SA#024] }
{================================================================================}
{ }
{ [ XSS and full path disclosure in Network Query Tool 1.6 ] }
{ }
{================================================================================}
Author: Janek Vind "waraxe"
Date: 23. April 2004
Location: Estonia, Tartu
Web: http://www.waraxe.us/index.php?modname=sa&id=24
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script takes a given hostname or IP address and attempts to
look up all sorts of information about that address. Basically
it does what network-tools.com does, without all the ads and ASP :)
COPYRIGHT shaun@shat.net
Homepage: http://www.shat.net/php/nqt/
Vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
A. Full path disclosure:
A1 - unchecked user submitted variable "portNum"
If we make http request like this:
http://localhost/nqt.php?target=foobar.com&queryType=all&portNum=foobar
... then we will see standard php error messages, revealing full path to script:
Warning: fsockopen() expects parameter 2 to be long, string given in D:\apache_wwwroot\nqt.php on lin
e 305
Port foobar does not appear to be open.
Reason is, that script does not check validity of the portNum, which must be integer in range of 1..6
5535.
B. Cross-site scripting aka XSS
B1 - XSS through unsanitaized user submitted variable "portNum"
http://localhost/nqt.php?target=foobar.com&queryType=all&portNum=foobar[xss code here]
Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greets to torufoorum members and to all bugtraq readers in Estonia! Tervitused!
Special greets to http://www.gamecheaters.us staff!
Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
come2waraxe@yahoo.com
Janek Vind "waraxe"
Homepage: http://www.waraxe.us/
---------------------------------- [ EOF ] ------------------------------------
|
|
