Full Disclosure mailing list archives
[bWM#014] Cross-Site-Scripting @ pathforwarding domains (multivendor: Strato, 1&1, HostEurope)
From: <ben.moeckel () badwebmasters net>
Date: Sun, 2 Nov 2003 18:14:01 +0100
http://badWebMasters.net ben moeckel security research ------------------------------------------------- badWebMasters security advisory #014 Cross-Site-Scripting @ pathforwarding domains (multivendor: Strato, 1&1, HostEurope) Discovery date: 2003-07-23 Original advisory: http://badwebmasters.net/advisory/014/ (text/html) Legal Notice: Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)! You may distribute it unmodified. You may not modify it and distribute it or distribute parts of it without giving credits and the URL where the original advisory can be found! This document may change without notice. Author: ben moeckel (http://distressed.de) mailto: badwebmasters () online de Description: Many webhoster offer a cheap way to get a own domain for a existing homepage (domainforwarding). To hide the real url (url-cloaking) those domains are based on a html-frameset. A malicious user may use the "pathforwarding"-feature to include javascript; Strato, 1&1 and HostEurope are vulnerable to this issue. Exploit: http://www.sampledomain.com/?"onLoad="alert(666) Vendor: All Vendors have been contacted, no response! 1&1 Internet AG - http://www.1und1.com Strato Medien AG - http://strato.de Host Europe - http://www.hosteurope.de Thanks: Thanks to "knuth" and "sir-markus" from aspforum.de Feedback: Comments, suggestions, updates, anything else? -> mailto:badwebmasters () online de __________________________________________ badWebMasters - ben moeckel security research http://badwebmasters.de http://badwebmasters.net copyright 2k1-3 by Benjamin Klimmek / Germany mailto:badwebmasters () online de _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [bWM#014] Cross-Site-Scripting @ pathforwarding domains (multivendor: Strato, 1&1, HostEurope) ben.moeckel (Nov 02)