[bWM#014] Cross-Site-Scripting @ pathforwarding domains (multivendor: Strato, 1&1, HostEurope)

[<ben.moeckel () badwebmasters net>]

http://badWebMasters.net 
ben moeckel security research 
------------------------------------------------- 

badWebMasters security advisory #014 
Cross-Site-Scripting @ pathforwarding domains (multivendor: Strato, 1&1,

HostEurope) 
Discovery date: 2003-07-23 
  
Original advisory: 
http://badwebmasters.net/advisory/014/ (text/html) 

  
Legal Notice: 
Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)! 
You may distribute it unmodified. 
You may not modify it and distribute it or distribute parts of it 
without giving credits and the URL where the original advisory can be 
found! 
This document may change without notice. 

  
Author: 
ben moeckel (http://distressed.de) 
mailto: badwebmasters () online de 

  
Description: 
Many webhoster offer a cheap way to get a own domain for a existing 
homepage (domainforwarding). To hide the real url (url-cloaking) those 
domains are based on a html-frameset. 

A malicious user may use the "pathforwarding"-feature to include 
javascript; Strato, 1&1 and HostEurope are vulnerable to this issue. 

  
Exploit: 
http://www.sampledomain.com/?"onLoad="alert(666) 

  
Vendor: 
All Vendors have been contacted, no response!  

1&1 Internet AG 
- http://www.1und1.com 

Strato Medien AG 
- http://strato.de 

Host Europe 
- http://www.hosteurope.de 

  
Thanks: 
Thanks to "knuth" and "sir-markus" from aspforum.de 

  
Feedback: 
Comments, suggestions, updates, anything else? 
  -> mailto:badwebmasters () online de 

  


__________________________________________ 

badWebMasters - ben moeckel security research 
http://badwebmasters.de http://badwebmasters.net 
copyright 2k1-3 by Benjamin Klimmek / Germany 
mailto:badwebmasters () online de

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html