Cross-Site Scripting Vulnerability in Microsoft Internet Explorer with Wildcard DNS Entry

vendor:

Internet Explorer

by:

Unknown

4.3

CVSS

MEDIUM

Cross-Site Scripting (XSS)

CWE

Product Name: Internet Explorer

Affected Version From: Unknown

Affected Version To: Unknown

Patch Exists: NO

Related CWE: CVE-2004-1159

CPE: a:microsoft:internet_explorer

Metasploit:

Other Scripts:

Platforms Tested: Windows

2004

Cross-Site Scripting Vulnerability in Microsoft Internet Explorer with Wildcard DNS Entry

Microsoft Internet Explorer is reported to contain a cross-site scripting vulnerability for sites that have a wildcard DNS entry. A web server with a wildcard DNS entry will respond to any hostname requested. Internet Explorer improperly interprets text inside of an anchor tag as HTML, rather than plaintext. An attacker can exploit this vulnerability by finding or creating a web site using a wildcard DNS entry and configuring it to display the hostname received in the request in the HTML returned to the user. This allows the attacker to potentially execute HTML or script code in the security context of the vulnerable site, leading to theft of cookie authentication credentials or other types of attacks.

Mitigation:

To mitigate this vulnerability, it is recommended to properly validate and sanitize user input to prevent the execution of malicious code. Web server configurations should also be reviewed to ensure that wildcard DNS entries are not being used in a vulnerable manner.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10554/info

Microsoft Internet Explorer is reported to contain a cross-site scripting vulnerability for sites that have a wildcard DNS entry.

A web server with a wildcard DNS entry will respond to any hostname requested. An example DNS entry of *.example.com would allow a hostname of whatevertheattackerwanted.example.com to properly resolve.

Internet Explorer improperly interprets text inside of an anchor tag as HTML, rather than plaintext.

To exploit this issue, an attacker must either find a preexisting web site using a wildcard DNS entry or create their own. The web site must also be configured to display the hostname received in the request in the HTML returned to the user. A remote attacker may exploit this issue to potentially execute HTML or script code in the security context of the vulnerable site.

An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.

<a href='http://"><plaintext>.example.com'>foo</a>

<a href='http://"><script>alert()<%2Fscript>.example.com'>foo</a>