OmniHTTPD HTML Injection Vulnerability

vendor:

OmniHTTPD

by:

SecurityFocus

7.5

CVSS

HIGH

HTML Injection

CWE

Product Name: OmniHTTPD

Affected Version From: OmniHTTPD 1.0

Affected Version To: OmniHTTPD 1.0

Patch Exists: YES

Related CWE: N/A

CPE: a:omnihttpd:omnihttpd:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows

2002

OmniHTTPD HTML Injection Vulnerability

A HTML injection vulnerability has been reported in the '/cgi-bin/redir.exe' sample CGI included with OmniHTTPD. Reportedly, it is possible for an attacker to URL encode the newline character (%0D) and insert malicious HTML code. A vulnerable server receiving a malformed request will return a 302 redirect HTTP response containing the malicious attacker-supplied code.

Mitigation:

Ensure that user-supplied input is properly validated and sanitized before being used in the generation of HTML output.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5572/info

OmniHTTPD is a webserver for Microsoft Windows operating systems. OmniHTTPD supports a number of CGI extensions which provide dynamic content.

A HTML injection vulnerability has been reported in the '/cgi-bin/redir.exe' sample CGI included with OmniHTTPD. Reportedly, it is possible for an attacker to URL encode the newline character (%0D) and insert malicious HTML code. A vulnerable server receiving a malformed request will return a 302 redirect HTTP response containing the malicious attacker-supplied code. 

http://localhost/cgi-bin/redir.exe?URL=http%3A%2F%2Fwww%2Eyahoo%2Ecom%2F%0D%
0A%0D%0A%3CSCRIPT%3Ealert%28document%2EURL%29%3C%2FSCRIPT%3E