REDHAT-BUG-446393: XSS
First published: Wed May 14 2008(Updated: )
Similarly as "alias" field in <a class="bz_bug_link bz_status_CLOSED bz_closed bz_public " title="CLOSED ERRATA - CVE-2007-3386 tomcat host manager xss" href="show_bug.cgi?id=247994">bug 247994</a> tomcat's host manager web interface suffers from javascript exploit in the "name" field: Assume that after logged in, the victim was lead to the malicious web server with following file installed. <form action="<a href="http://localhost:8080/host-manager/html/add">http://localhost:8080/host-manager/html/add</a>" method="get"> <INPUT TYPE="hidden" NAME='name' VALUE="<script>alert()</script>"> <INPUT TYPE="hidden" NAME='aliases' VALUE="somealias"> <input type="submit"> </form> Steps to reproduce: * install tomcat5 tomcat5-admin-webapps. * edit /etc/tomcat5/tomcat-users.xml and add <role rolename="tomcat"/> <user username="tomcat" password="tomcat" roles="tomcat,admin"/> * restart tomcat5 * Visit <a href="http://localhost:8080/host-manager/html/add">http://localhost:8080/host-manager/html/add</a> * login with user name tomcat and password tomcat * Enter the following: name: <script>alert("name-exploit!")</script> alias: somealias * hit add. * You should see the javascript alert box popping up.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tomcat |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=247994
- http://localhost:8080/host-manager/html/add
- http://svn.apache.org/viewvc?view=rev&revision=662582
- http://marc.info/?l=tomcat-user&m=121244319501278&w=2
- http://tomcat.apache.org/security-5.html
- http://tomcat.apache.org/security-6.html
- http://admin.fedoraproject.org/updates/tomcat6-6.0.18-1.1.fc9
- http://admin.fedoraproject.org/updates/tomcat5-5.5.27-0jpp.1.fc8
- http://admin.fedoraproject.org/updates/tomcat5-5.5.27-0jpp.2.fc9
- http://admin.fedoraproject.org/updates/tomcat5-5.5.27-0jpp.2.fc8
- https://www.redhat.com/security/data/cve/CVE-2008-1947.html
- https://bugzilla.redhat.com/show_bug.cgi?id=446393
- agent/references
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-1947
- agent/severity
- agent/weakness
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/tomcat