SonicWall E-mail Security version 6.1.1 suffers from a cross site scripting vulnerability via the Host: header.
f7fcac283c39a39b7ba7514782f15b4fc283957bfc523140dbe2cbdef590cfd5
Affected Software/Device: SonicWall E-mail Security
Version: 6.1.1
Vulnerability: Cross Site Scripting
Risk: Low
Description: SonicWALL Email Security is award-winning anti-spam,
anti-virus, anti-phishing, policy, and compliance management e-mail
protection solution. Available as a hardened appliance or as Windows
software, SonicWALL Email Security protects inbound and outbound e-mail
for organizations of less than 25 to over 100,000 users.
Sonicwall web application utilizes host header for serving 404 Error
pages. The vulnerability can be exploited by requesting a non-existing
web page with a specially crafted host header. As the application does
not properly sanitize the data contained in the host header, desired
script code can be run on client browser.
Sample Request:
GET /blah.htm HTTP/1.1
Host: "><script>alert('XSS');</script>
Deniz CEVIK
www.intellectpro.com.tr