Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:18396
HistoryNov 14, 2007 - 12:00 a.m.

AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service

2007-11-1400:00:00
vulners.com
23

======================================================================
AutoIndex <= 2.2.2 Cross Site Scripting and Denial of Service

Author: L4teral <l4teral [4t] gmail com>
Impact: Cross Site Scripting
Denial of Service (DoS)
Status: patch available


Affected software description:

Application: AutoIndex
Version: <= 2.2.2/2.2.3
Vendor: http://autoindex.sourceforge.net


Vulnerability:

The variable $_SERVER['PHP_SELF'] is not properly sanitized
leading to cross site scripting.

The use of unsanitized user input causes an error in the recursive
calculation of the size of a directory leading to cpu time/memory
consumption until the process gets killed.


PoC/Exploit:

http://<host>/AutoIndex/index.php/"><script>alert(document.cookie)</script>

http://<host>/AutoIndex/index.php?dir=%00


Solution:

update to version 2.2.4.


Timeline:

2007-11-05 - vendor informed
2007-11-05 - vendor released version 2.2.3 (fixing XSS)
2007-11-09 - vendor released version 2.2.4 (fixing DoS)
2007-11-12 - public disclosure