This is a multi-part message in MIME format. ------_=_NextPart_001_01C6A369.3FE6BA2F Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable =20 MIMESweeper For Web 5.X Cross Site Scripting =20 =20 I. INTRODUCTION =20 MIMESweeper For Web is a policy-based content security for web applications. It analyzes web content and blocks pages or files that are prohibited by the organizational security policy. =20 For more Information please refer to: http://www.clearswift.com/products/msw/msw_web/default.aspx =20 =20 II. DESCRIPTION =20 A XSS vulnerability was discovered by Erez Metula. When accessing a URL which is not permitted the user is redirected to an "access denied" page that is vulnerable to XSS. The page does not input validate / HTML Encode the input and displays the data "as is". =20 Usually this means that it enables an attacker to inject HTML or Javascript code into users's browsers, and by that bypassing the browser DOM restrictions. This javascript code can perform actions on behalf of the user, steal authentication cookies, change the appearance of web pages, perform phishing ,and generally can do everything to the original page. =20 =20 III. EXPLOITATION =20 The vulnerability can be exploited by just redirecting the client to some URL that is restricted by MIMESweeper policy and adding the script at the end of the URL. =20 Example PoC: http://SomeBlackListedSite/ > =20 =20 IV. IMPACT =20 Using the MIMESweeper capabilities of a central gateway to spread malicious scripts to users. An example attack scenario could be that an attacker will redirect many users (by email, posting in the organization portal, etc.) to some blocked URL and an accompanying script that will steal their authentication cookies. =20 V. DETECTION =20 Detection of this vulnerability involves injecting some HTML tags / scripts to a blocked URL that will be responded by the MIMESweeper with the vulnerable page. =20 VI. WORKAROUND =20 Clearswift released a patch for this vulnerability, following the initial contact ¬ification. The patch can be obtained from: http://www.clearswift.com/support/msw/patch_MswWeb.aspx termed as "MIMEsweeper for Web 5.1.15 Hotfix" =20 =20 VII. VENDOR RESPONSE =20 Clearswift has been informed on the 27/6/06 by e-mail to their support. Clearswift released a fixed version of the software. =20 =20 VIII. DISCLOSURE TIMELINE =20 27/06/06 Identification of the flaw 27/06/06 Reporting the flaw to clearswift by email 27/06/06 Response from clearswift, asking for more description 27/06/06 Providing the full description to clearswift 28/06/06 Clearswift acknowledge of the vulnerability 06/07/06 Patch released by clearswift 09/07/06 Public advisory =20 =20 IX. CREDITS =20 The vulnerability was discovered by Erez Metula. =20 Erez Metula, CISSP =20 Application Security Department Manager Security Software Engineer E-Mail: erezmetula@2bsecure.co.il =20 =20 =20 =20 ------_=_NextPart_001_01C6A369.3FE6BA2F Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

 

MIMESweeper For Web 5.X = Cross Site Scripting

 

 

I. = INTRODUCTION

 

MIMESweeper For Web is a = policy-based content security for web applications. It analyzes web content and = blocks pages or files that are prohibited by the organizational security = policy.

 

For more Information please = refer to:

http= ://www.clearswift.com/products/msw/msw_web/default.aspx

 

 

II. = DESCRIPTION

 

A XSS vulnerability was = discovered by Erez Metula. When accessing a URL which is not permitted the user is redirected to an "access denied" page that is vulnerable to = XSS. The page does not input validate / HTML Encode the input and displays the data = "as is".

 

Usually this means that it enables an attacker to inject HTML or Javascript code = into users's browsers, and by that bypassing the browser DOM = restrictions.

This javascript code can perform actions on behalf of the user, steal = authentication cookies, change the appearance of web pages, perform phishing ,and = generally can do everything to the original page.

 

 

III. = EXPLOITATION

 

The vulnerability can be exploited by just redirecting the client to some = URL that is restricted by MIMESweeper policy and adding the script at the end of = the URL.

 

Example PoC:

http://= SomeBlackListedSite/<script>PAYLOAD</script>

 

 

IV. = IMPACT

 

Using the MIMESweeper = capabilities of a central gateway to spread malicious scripts to = users.

An example attack scenario = could be that an attacker will redirect many users (by email, posting in the organization portal, etc.) to some blocked URL and an accompanying = script that will steal their authentication cookies.

 

V. = DETECTION

 

Detection of this = vulnerability involves injecting some HTML tags / scripts to a blocked URL that will be = responded by the MIMESweeper with the vulnerable page.

 

VI. = WORKAROUND

 

Clearswift released a patch = for this vulnerability, following the initial contact = &notification.

The patch can be obtained = from:

http://w= ww.clearswift.com/support/msw/patch_MswWeb.aspx

termed as "MIMEsweeper for Web 5.1.15 = Hotfix"

 

 

VII. VENDOR = RESPONSE

 

Clearswift has been = informed on the 27/6/06 by e-mail to their support.

Clearswift released a fixed = version of the software.

 

 

VIII. DISCLOSURE = TIMELINE

 

27/06/06 =            = Identification of the flaw

27/06/06 =            Reporting the flaw to clearswift by email

27/06/06 =            Response from clearswift, asking for more = description

27/06/06 =            Providing the full description to clearswift

28/06/06 =            Clearswift acknowledge of the vulnerability

06/07/06 =            Patch released by clearswift

09/07/06 =            Public advisory

 

 

IX. = CREDITS

 

The vulnerability was = discovered by Erez Metula.

 

Erez Metula, CISSP   
Application Security Department Manager

Security Software Engineer

E-Mail:  = erezmetula@2bsecure.co.il=

 

 

 

------_=_NextPart_001_01C6A369.3FE6BA2F--