J-Security Center

Title: SSL-Explorer Multiple Input Validation Vulnerabilities

Severity: MODERATE

Description:

SSL-Explorer is a web-based SSL VPN server.

SSL-Explorer is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input.

These issues include:

- An HTML-injection issue. This occurs because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. Specifically, HTML code may be injected into the 'forwardTo' parameter in the 'redirect.do' script.

Versions of SSL-Explorer prior to 0.2.13 are vulnerable.

This issue is being tracked by CVE-2007-2907.

- A directory-traversal vulnerability. The application fails to properly sanitize user-supplied input to the 'path' parameter of the 'fileSystem.do' script.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

Versions of SSL-Explorer prior to 0.2.14 are vulnerable.

This issue is being tracked by CVE-2007-5831.

- HTML and script-code injection before HTTP responses. Specifically, this issue occurs in the 'locale' parameter of the 'selectLanguage.do' script.

Versions of SSL-Explorer prior to 0.2.15 are vulnerable.

This issue is being tracked by CVE-2007-5832

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, compromise the application, obtain sensitive information, and access or modify data.

Affected Products:

  • 3sp SSL-Explorer 0.1.16

References:

Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.