Hi, while doing a pen-test I found what seems a Cross Site Scriptting on Microsoft Content Management Server. On M$ words: "Microsoft® Content Management Server 2001 (MSCMS) is an enterprise Web content management system that enables companies to build, deploy, and maintain Internet, intranet, and extranet Web environments. One essential component of the Web development process is the planning and implementation of a security policy for the site.(...)" Within Microsoft Content Management Server, the AESecurity Service authenticates users. In this forms-based authentication system, users trying to access a secure Web page are redirected to a login form (an Active Server Pages [ASP] script called ManualLogin.asp) where they must enter a user name and password. After the user enters credentials, the ASP script does an HTML post of the login credentials to an ASP script called ManualLoginSubmit.asp, which communicates the data to the server. If user authentication succeeds, MSCMS saves a session cookie with an encrypted token in the Web browser. The token is comprised of the user identity, the time of login, and the login IP address; it is encrypted in the cookie with the Server Security Key. Each time the user requests a new page, MSCMS validates the token and grants or denies access accordingly. When the user logs off, the token is removed from the Web browser, and when the browser is closed, the session cookie is destroyed OK. The ManualLogin.asp has a parameter "REASONTXT" that shows the usual warning text:"You are using an insecure connection...". But we can inject code here like this: ManualLogin.asp? REASONTXT=<YOUR_SCRIPT>. An example coud be: http://vulnerable_site/NR/System/Access/ManualLogin.asp? REASONTXT=<script>alert(document.cookie);window.open ("http://www.infohacking.com";);</SCRIPT> This demo-script has been intentionally contructed in this way (we don`t want people sending their cookies to our site...) So, if we can force a user to open an URL like this (HTML mail for example), we could trick him to send his cookie.If the user has just log on to the vulnerable server, we will probably be able to steal his cookie and hijack his session... Sorry for my bad english. Hugo Vazquez Carames & Toni Cortes Martinez www.infohacking.com Thanks to our company (www.winmat.com) to let us lose time on investigating this "feature".
