Dear bugTraq, Cross application scripting attacks (data obtained from untrusted source is sent unfiltered from trusted application to browser) in different applications are reported by anonymous author. In Russian version of article "XSS - WEB = Cross-Applications Scripting" (signed (c)oded by QQLan@yandex.ru) http://www.security.nnov.ru/articles/xas/ there are remote cross-application scripting attack in SPIDynamics WebInspect and domain level cross-application attack with potential privilege escalation for user with limited delegated control under OU to domain administrator account is also described for Windows domain group policy editor (gpedit.msc) under Windows XP and Windows Server 2003. Below is original anonymous report for cross application scripting in SPIDynamics WebInspect (http://www.security.nnov.ru/Fnews30.html) SPIDynamics WebInspect Cross-Application Scripting (XAS) I. BACKGROUND SPIDynamics WebInspect is powerful security assessment tool for Web application vulnerable to XAS which could lead to remote code execution. II. DESCRIPTION As many applications WebInspect uses external programs and Windows components for different purposes. It is very common to use COM object of Internet Explorer for render reports and displays data. WebInspect in not an exception. When reports is generated, some parts of scanned site (for example URLs) are included into HTML file (file://C:\Program Files\SPIDynamics\WebInspect\Working\vulnerability.htm), which opens in IE. Because WebInspect doesn't properly normalize displayed data, part of URL or other data can be parsed by IE as DHTML, for example JavaScript, and leads to code execution on the computer where scanner is installed. III. ANALYSIS Successful exploitation allows remote attackers to execute arbitrary script code on the host, where scanner is installed with privileges of user who launch the scanner. Victim should scan site and open report. Typically scanner runs on administrator's or security auditor's box with a lot of interesting data. It possibly runs under high-privileged account. Attacker should create specially crafted site with vulnerability to be displayed in report. "Vulnerable" URL should include script code. Example of such report is a "Hidden Form Value Vulnerability ID: 4727". By default script is executed in Internet Security Zone of IE (not sure). But with little effort attacker can use predictable resource location to bypass restrictions of Internet Zone and execute script in "My Computer" security zone. Example: Attacker can use social engineering to install full featured application, for example new version of "SPIDynamics Reported ActiveX". IV. DETECTION/POC Following asp file can be used to reproduce vulnerability: <*****************iisstart.asp***********************> <% if request.querystring<>"" then response.write request.querystring end if %>
Please login:


You should change default error page to iisstart.asp (see screenshot in attach). Scan results can be found in attached files. V. VENDOR RESPONSE Initial vendor response received VII. DISCLOSURE TIMELINE 04/15/2005 Initial vendor notification 04/15/2005 Initial vendor response VIII. WORKAROUND Disable Active Scripting in My Computer Zone (http://support.microsoft.com/default.aspx?scid=kb;en;833633) IX. LEGAL NOTICES This advisory is being provided to you under the RFPolicy documented at http://www.wiretrip.net/rfp/policy.html. You are encouraged to read this policy; however, in the interim, you have approximately 5 days to respond to this initial email. Thanks: 3APA3A for spellcheck & malware.com for some ideas.