CERT-In Vulnerability Note
CIVN-2013-0218
Microsoft ASP.NET SignalR Cross Site Scripting Vulnerability
Original Issue Date:December 11, 2013
Severity Rating: HIGH
Systems Affected
- ASP.NET SignalR 1.1.x.
- ASP.NET SignalR 2.0.x.
- Microsoft Visual Studio Team Foundation Server 2013
Overview
A vulnerability has been reported in Microsoft ASP.Net SignalR, which could allow a remote attacker to perform cross-site scripting (XSS) attacks.
Description
This vulnerability exists due to improper validation of users input by ASP.Net SignalR. A remote attacker could exploit this vulnerability by persuading a user to follow a malicious link or access a attacker- controlled website.
Successful exploitation of this vulnerability could allow the attacker to execute specially crafted java script into users browser to modify page content, conduct phishing or perform actions on behalf of target user.
Workaround
- For Windows servers that host web applications using ASP.NET SignalR functionality, turning off the ASP.NET SignalR Forever Frame transport protocol provides temporary protection from the vulnerability.
Solution
Apply appropriate updates as mentioned in the Microsoft security bulletin
MS13-103
Vendor Information
Microsoft
http://technet.microsoft.com/en-us/security/bulletin/ms13-103
References
Security Tracker
http://securitytracker.com/id/1029463
Cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=31990
Secunia
http://secunia.com/advisories/55991/
CVE Name
CVE-2013-5042
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|