Aladdin eSafe Gateway过滤绕过漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1106361 漏洞类型 未知
发布时间 2001-05-29 更新时间 2001-08-14
CVE编号 CVE-2001-0519 CNNVD-ID CNNVD-200108-057
漏洞平台 Multiple CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/20890
https://www.securityfocus.com/bid/88850
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200108-057
|漏洞详情
AladdineSafeGateway2.x版本存在漏洞。远程攻击者可以借助含被嵌入在其他SCRIPT标签内的SCRIPT标签的HTML标签特殊参数来绕过HTMLSCRIPT过滤。
|漏洞EXP
source: http://www.securityfocus.com/bid/2800/info

eSafe Gateway is a security utility used for filtering internet content.

It is possible to craft an html file that slips through eSafe Gateway's script filtering feature. eSafe Gateway will ignore scripting commands that are embedded in any html tags that allow it. This causes eSafe Gateway to generate filtered html that still includes potentially dangerous scripting functions. 

For example, the following potentially harmful script will go
undetected by eSafe, even if the "remove all scripts" option is enabled:


<A HREF="javascript:var fso = new
ActiveXObject('Scripting.FileSystemObject');var a =
fso.CreateTextFile('c:\\testfile2.txt', true);a.WriteLine('This is a
test.');a.Close();">Click here</A>

HREF is not the only tag ignored. Any tag capable of containing scripting
command will not be filtered by eSafe. For example:

<BODY onload="alert('hi');">
|受影响的产品
Aladdin Knowledge Systems Esafe Gateway 2.0
|参考资料

来源:BUGTRAQ
名称:20010529AladdineSafeGatewayFilterBypass-UpdatedAdvisory
链接:http://archives.neohapsis.com/archives/bugtraq/2001-05/0282.html
来源:XF
名称:esafe-gateway-bypass-filtering(6580)
链接:http://xforce.iss.net/static/6580.php