-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



SA0004

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+++++         Antville 1.1 Cross Site Scripting         +++++
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


PUBLISHED ON
  Nov 09, 2005


PUBLISHED AT
  http://moritz-naumann.com/adv/0004/antvxss/0004.txt
  http://moritz-naumann.com/adv/0004/antvxss/0004.txt.sig


PUBLISHED BY
  Moritz Naumann IT Consulting & Services
  Hamburg, Germany
  http://moritz-naumann.com/

  info AT moritz HYPHON naumann D0T com
  GPG key: http://moritz-naumann.com/keys/0x277F060C.asc


AFFECTED APPLICATION OR SERVICE
  Antville
  http://www.antville.org/


AFFECTED VERSION
  Version 1.1
  Possibly versions 1.0 and lower (untested)


BACKGROUND
  Everybody knows XSS.
  http://en.wikipedia.org/wiki/XSS
  http://www.cgisecurity.net/articles/xss-faq.shtml


ISSUE
  A XSS vulnerability has been detected in Antville. The
  problem is caused by insufficient input sanitation.

  By making a victim visit a specially crafted URL, it is
  possible to inject client side scripting (such as
  Javascript) and HTML which will be executed/rendered in
  her browser.

  The following URL demonstrates this issue:
    [antville_basepath]/project/<script>alert('XSS');</script>

  This may not be easily exploitable for cookie/session
  stealing attacks due to the IP address lock on the session.


WORKAROUND
  Client: Disable Javascript.
  Server: Prevent access to the Antville installation.


SOLUTIONS
  There does not seem to be a patch available. Our attempts
  to contact the developers were unsuccessful.


TIMELINE
  Sep 19, 2005  Discovery
  Sep 19, 2005  Code maintainer notification
  Sep 29, 2005  Another code maintainer notification
  Nov 09, 2005  Public disclosure


REFERENCES
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3530


ADDITIONAL CREDIT
  N/A


LICENSE
  Creative Commons Attribution-ShareAlike License Germany
  http://creativecommons.org/licenses/by-sa/2.0/de/



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDcikon6GkvSd/BgwRAvgIAJ9T6KB39w9Hk3OcJ56I+F6lLRoKWACfTR2c
dz7aukUAwcxTA5/q12mWrsA=
=QLOX
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/