Vulnerability Note VU#246409

CGI.pm vulnerable to Cross-site Scripting

Original Release date: 07 Oct 2003 | Last revised: 23 Feb 2004

Overview

A vulnerability in the Common Gateway Interface (CGI) Perl module may allow an attacker to mount a cross-site scripting attack against a vulnerable system.

Description

The Common Gateway Interface, or CGI, is a standard for external gateway programs to interface with information servers such as HTTP servers. The standard Perl distribution and many vendor's repackaged Perl systems include a CGI library known as CGI.pm. This module offers a set of functions for creating fill-out forms, among other things.

Some versions of the CGI.pm module contain a vulnerability in handling of the action in the start_form() and start_multipart_form() functions. When the action for the form is not specified, a default based on the user-supplied URL is used. Because the value of this expression is not sanitized by the module before processing and contains user-supplied data or data received from untrustworthy sources, a remote attacker may be able to inject HTML or malicious script. A user of the vulnerable site or web application may then be tricked into interpreting the HTML or executing the script in a situation where they normally might not.

Impact

The victim will be presented with information that the vulnerable site did not wish their visitors to be subjected to. This could be used to "sniff" sensitive data from within the web page, including passwords, credit card numbers, and any arbitrary information the user inputs. This exploitation vector is commonly referred to as a cross-site scripting attack.

Solution

Apply a patch from the vendor

Versions 2.94 and later of the CGI.pm module contain a fix for this vulnerability. Please see the vendor section of this document for further details.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
ConectivaAffected-30 Jul 2003
DebianAffected-21 Aug 2003
Lincoln SteinAffected-07 Oct 2003
MandrakeSoftAffected-02 Sep 2003
OpenBSDAffected-02 Sep 2003
OpenPKGAffected-07 Oct 2003
Red Hat Inc.Affected-07 Oct 2003
SCOAffected-13 Nov 2003
Sun Microsystems Inc.Affected-11 Feb 2004
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Obscure for reporting this vulnerability.

This document was written by Chad R Dougherty with feedback from Sean Levy.

Other Information

  • CVE IDs: CAN-2003-0615
  • Date Public: 19 Jul 2003
  • Date First Published: 07 Oct 2003
  • Date Last Updated: 23 Feb 2004
  • Severity Metric: 15.00
  • Document Revision: 10

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.