The calendar application for Apache Tomcat contains invalid HTML which renders the cross site scripting protection for the time parameter ineffective. An attacker can therefore perform an cross site scripting attack using the time attribute. Version affected include Tomcat 6.0.0 to 6.0.18, Tomcat 5.5.0 to 5.5.27, and Tomcat 4.1.0 to 4.1.39.
2fd4d18e046935391c0b4eb23d19aed3bf6cd14d57e11ae2522468cf694b91a4
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
CVE-2009-0781: Apache Tomcat cross-site scripting vulnerability
Severity: low
Vendor:
The Apache Software Foundation
Versions Affected:
Tomcat 6.0.0 to 6.0.18
Tomcat 5.5.0 to 5.5.27
Tomcat 4.1.0 to 4.1.39
Description:
The calendar application in the examples contains invalid HTML which
renders the XSS protection for the time parameter ineffective. An
attacker can therefore perform an XSS attack using the time attribute.
Mitigation:
6.0.x users should do one of the following:
- remove the examples web application
- apply this patch https://svn.apache.org/viewvc?rev=750924&view=rev
- upgrade to 6.0.19 when released
5.5.x users should do one of the following:
- remove the examples web application
- apply this patch https://svn.apache.org/viewvc?rev=750928&view=rev
- upgrade to 5.5.28 when released
4.1.x users should do one of the following:
- remove the examples web application
- apply this patch https://svn.apache.org/viewvc?rev=750927&view=rev
- upgrade to 4.1.40 when released
Example:
https://localhost:8080/examples/jsp/cal/cal2.jsp?time=8am%20STYLE=xss:e/**/xpression(try{a=firstTime}catch(e){firstTime=1;alert('XSS')});
Credit:
This issue was discovered by Deniz Cevik.
References:
https://tomcat.apache.org/security.html
https://tomcat.apache.org/security-6.html
https://tomcat.apache.org/security-5.html
https://tomcat.apache.org/security-4.html
The Apache Tomcat Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - https://enigmail.mozdev.org
iD8DBQFJsUexb7IeiTPGAkMRAnQkAKDSvIKgXQTCEOdYo0T1Ms0ze07qWQCgh2Af
7M0rD3B+d5vu90/ode27FLI=
=Y8kB
-----END PGP SIGNATURE-----