AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service
- From: L4teral <l4teral@xxxxxxxxx>
- Date: Mon, 12 Nov 2007 21:32:35 +0100
- Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=tCgaOoXweKGURYvgAVya0FHHYvwhyCsqyFoIobaQfJQ=; b=tL8L6V0LJb4HamUkbcTBQlm6Hxfhk64hv+ErPIExO0EPbYUxSLnzhYVnbzkN88oK3RyMC2xu/cS8Z6uQvJJoKhc5ThKqSQ3aI+JMkY18GnH5XEk/dIq/Qk/i8kqq2hVYUcL8xmLQVZqvRg8mEIbfK5BDIWihaaosBp0kx2PGYsE=
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=VzE+QzWvG/fzHvdw2kfyjqN1Nwd6RmJC52d1cW4PKNQkjczfDYfcsCQFIvrCfNVxtmpQ45b6BiEaiuHe91YypVMaKwjq/gdSbybhtgrf1zNY0sWhlIehZay4INHmNcrbmVrR9hODSffpK+5zjulJmPa7KiejnDJWVkP0u7SNLUo=
- List-help: <mailto:bugtraq-help@securityfocus.com>
- List-id: <bugtraq.list-id.securityfocus.com>
- List-post: <mailto:bugtraq@securityfocus.com>
- List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
- List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
- Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
======================================================================
AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service
======================================================================
Author: L4teral <l4teral [4t] gmail com>
Impact: Cross Site Scripting
Denial of Service (DoS)
Status: patch available
------------------------------
Affected software description:
------------------------------
Application: AutoIndex
Version: <= 2.2.2/2.2.3
Vendor: http://autoindex.sourceforge.net
--------------
Vulnerability:
--------------
1.
The variable $_SERVER['PHP_SELF'] is not properly sanitized
leading to cross site scripting.
2.
The use of unsanitized user input causes an error in the recursive
calculation of the size of a directory leading to cpu time/memory
consumption until the process gets killed.
------------
PoC/Exploit:
------------
1.
http://<host>/AutoIndex/index.php/"><script>alert(document.cookie)</script>
2.
http://<host>/AutoIndex/index.php?dir=%00
---------
Solution:
---------
update to version 2.2.4.
---------
Timeline:
---------
2007-11-05 - vendor informed
2007-11-05 - vendor released version 2.2.3 (fixing XSS)
2007-11-09 - vendor released version 2.2.4 (fixing DoS)
2007-11-12 - public disclosure