hello nessus report cookie injection.
Synopsis: The remote web server is prone to a cookie injection attack.
Description
The remote host is running a web server that fails to adequately
sanitize request strings of malicious JavaScript. By leveraging this
issue, an attacker may be able to inject arbitrary cookies. Depending
on the structure of the web application, it may be possible to launch
a 'session fixation' attack using this mechanism.
Please note that :
- Nessus did not check if the session fixation attack is
feasible.
- This is not the only vector of session fixation.
Solution
Contact the vendor for a patch or upgrade.
See Also
http://en.wikipedia.org/wiki/Session_fixation
http://www.owasp.org/index.php/Session_Fixation
http://www.acros.si/papers/session_fixation.pdf
http://projects.webappsec.org/Session-Fixation
Risk Factor: Medium
CVSS Base Score
4.3 (CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
Plugin Output
The request string used to detect this flaw was :
<script>document.cookie=%22testkzqg=5603;%22</script>
The output was :
HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=utf-8
Server: Mono-HTTPAPI/1.0
Date: Wed, 24 Aug 2011 15:39:32 GMT
Content-Length: 118
Connection: close
<h1>Bad Request (Invalid url: http://sd001.**********.eu:8890<script>document.cookie="testkzqg=5603;"</script>)</h1>
Plugin Publication Date: 2010/01/25
Plugin Last Modification Date: 2011/03/14