Fastream NetFile 6.0.3.588 - Error Message Cross-Site Scripting

Author: Oliver Karow
type: remote
platform: multiple
port: 
date_added: 2003-10-28 
date_updated: 2012-12-11 
verified: 1 
codes: CVE-2003-1151;OSVDB-2732 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/8908/info

It has been reported that a cross-site scripting vulnerability may exist in NetFile that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to a "404 Not Found" error message returned to the user due to a request for a URL that does not exist. The error message reportedly contains the bad URL which is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

NetFile FTP/Webserver Version 6.0.3.588 has been reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/<script>alert("bang")</script>