[Full-disclosure] SonicWall e-mail security Host Header XSS Vulnerability

[Deniz Cevik]

Affected Software/Device: SonicWall E-mail Security

 

Version: 6.1.1

 

Vulnerability: Cross Site Scripting

 

Risk: Low

 

Description: SonicWALL Email Security is award-winning anti-spam,
anti-virus, anti-phishing, policy, and compliance management e-mail
protection solution. Available as a hardened appliance or as Windows
software, SonicWALL Email Security protects inbound and outbound e-mail
for organizations of less than 25 to over 100,000 users.

 

Sonicwall web application utilizes host header for serving 404 Error
pages. The vulnerability can be exploited by requesting a non-existing
web page with a specially crafted host header. As the application does
not properly sanitize the data contained in the host header, desired
script code can be run on client browser.

 

 

Sample Request:

 

GET /blah.htm HTTP/1.1

Host: "><script>alert('XSS');</script>

 

Deniz CEVIK

www.intellectpro.com.tr

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20080508/69d754b4/attachment.html