Full Disclosure mailing list archives
SonicWall e-mail security Host Header XSS Vulnerability
From: "Deniz Cevik" <Deniz.Cevik () intellect com tr>
Date: Thu, 8 May 2008 18:04:54 +0300
Affected Software/Device: SonicWall E-mail Security Version: 6.1.1 Vulnerability: Cross Site Scripting Risk: Low Description: SonicWALL Email Security is award-winning anti-spam, anti-virus, anti-phishing, policy, and compliance management e-mail protection solution. Available as a hardened appliance or as Windows software, SonicWALL Email Security protects inbound and outbound e-mail for organizations of less than 25 to over 100,000 users. Sonicwall web application utilizes host header for serving 404 Error pages. The vulnerability can be exploited by requesting a non-existing web page with a specially crafted host header. As the application does not properly sanitize the data contained in the host header, desired script code can be run on client browser. Sample Request: GET /blah.htm HTTP/1.1 Host: "><script>alert('XSS');</script> Deniz CEVIK www.intellectpro.com.tr
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- SonicWall e-mail security Host Header XSS Vulnerability Deniz Cevik (May 08)