Inktomi Traffic Server 4.0/5.x - Cross-Site Scripting

Author: Hugo Vazquez
type: remote
platform: linux
port: 
date_added: 2003-05-14 
date_updated: 2012-11-10 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/7596/info

Inktomi Traffic Server is prone to a cross-site scripting vulnerability. This is due to insufficient sanitization of input passed to the proxy, which will be echoed back in error pages under some circumstances. A malicious attacker could exploit this issue by creating a link which contains hostile HTML and script code and then enticing users of the proxy to visit the link. When the link is visited via the proxy, attacker-supplied script may be interpreted in the user's browser.

Exploitation could permit HTML and script code to access properties of the domain that is requested through the proxy.

http://<spoofed_domain>:443/</em><script>alert()</script>