Apache Input Validation Hole in mod_status Permits Cross-Site Scripting

Last Updated on Monday, 04 February 2008 19:40

[Summary]

A vulnerability was reported in Apache mod_status. A remote user can
conduct cross-site scripting attacks.

The mod_status module does not properly filter HTML code from
user-supplied input before displaying the input. A remote user can
cause arbitrary scripting code to be executed by the target user's
browser. The code will originate from the site running the Apache
software and will run in the security context of that site. As a
result, the code will be able to access the target user's cookies
(including authentication cookies), if any, associated with the site,
access data recently submitted by the target user via web form to the
site, or take actions on the site acting as the target user.

[Solution]

The vendor has issued a fix (1.3.40-dev, 2.0.61-dev).

[Reference]

http://httpd.apache.org/