多个供应商的互联网浏览器的cookie路径参数限制绕过漏洞

漏洞ID	1107777	漏洞类型	路径遍历
发布时间	2004-03-10	更新时间	2005-10-20
CVE编号	CVE-2003-0514	CNNVD-ID	CNNVD-200404-052
漏洞平台	OSX	CVSS评分	7.5

|漏洞来源

https://www.exploit-db.com/exploits/23800
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200404-052

|漏洞详情

AppleSafari存在漏洞。远程攻击者可以通过URL中”%2e%2e”（编码的点点）的目录遍历序列来绕开web应用上预期的cookie访问权限，该漏洞导致Safari发送指定的URL子集以外的cookie，例如：与目标应用程序运行在同一服务器上的易受攻击的应用程序。

|漏洞EXP

source: http://www.securityfocus.com/bid/9841/info

Multiple vendor Internet Browsers have been reported to be prone to a cookie path argument restriction bypass vulnerability. The issue presents itself due to a failure to properly sanitize encoded URI content, this may make it possible for an attacker to craft a URI that will contain encoded directory traversal sequences sufficient to provide access to a supposedly path exclusive cookie from an alternate path.

http://www.example.com/secure/%2e%2e/sample/insecure.cgi?xss=<golarge>

|参考资料

来源:FULLDISC
名称:20040310CorsaireSecurityAdvisory:MultiplevendorHTTPuseragentcookiepathtraversalissue
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2004-March/018475.html
来源:VULNWATCH
名称:20040310CorsaireSecurityAdvisory:MultiplevendorHTTPuseragentcookiepathtraversalissue
链接:http://archives.neohapsis.com/archives/vulnwatch/2004-q1/0056.html

相关推荐: Microsoft JVM Passed HTML Object Reference Denial Of Service Vulnerability

Microsoft JVM Passed HTML Object Reference Denial Of Service Vulnerability 漏洞ID 1101346 漏洞类型 Failure to Handle Exceptional Conditi…