Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun" Oct 31 2006 04:33PM
LegendaryZion (moskito smile net il)

·= Security Advisory =·

Issue: Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server
Messenger Express by "Sun"
Discovered Date: 25/09/2006
Author: Tal Argoni, LegendaryZion. [talargoni at]
Product Vendor:


iPlanet Messaging Server Messenger Express by "Sun" is prone to a Cross Site
Scripting Vulnerability.
The vulnerability exists in filter engine, caused by the lack of Input
of malicious Method "Expression()" of Cascading Style Sheets (CSS).

About Cascading Style Sheets (CSS):

Cascading Style Sheets (CSS) is a stylesheet language used to describe the
of a document written in a markup language. Its most common application is
to style web pages written
in HTML and XHTML.

About Expression() Method:

Receive string that specifies any valid script(JScript, JavaScript,
statement without quotations or semicolons. This string can include
references to
other properties on the current page. Array references are not allowed on
properties included in this script.

<ELEMENT STYLE="AttributeName:expression(Script)">

Exploitation Mail:

Content-Type: text/html;

<IMG width="0" height="0" style="width: expression(alert('expression'));">

Successful exploitation may allow execution of script code. This could also
be exploited
to execute malicious scripts, spoof the entire website's content, stealing
cookies, stealing session ID,
commit Denial Of Service attacks and more...

Proof Of Concept:

<IMG style="width: expression(alert('expression'));">

google it

Israels ISP using the web mail:
Netvision -
012 -

Around the globe:
The City University of New York -

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus