{"vuid":"VU#139931","idnumber":"139931","name":"Microsoft SQLXML HTTP components vulnerable to cross-site scripting via root parameter","keywords":["Microsoft","SQLXML","filter","cross-site scripting","css","XML tag","Q321911","MS02-030","xss"],"overview":"A cross-site scripting vulnerability exists in the Microsoft SQLXML HTTP components. This vulnerability could allow an attacker to execute script on a victim's system with the victim's privileges.","clean_desc":"Microsoft SQL Server 2000 includes a feature called SQLXML that allows the server to handle SQL queries and responses via XML. IIS enables XML over HTTP using the SQLXML HTTP components. A client SQLXML HTTP request takes the form of a URI that contains a number of arguments including the name of the IIS server, the virtual directory (virtual root), and optional parameters. One of the optional parameters, root, wraps top-level XML tags around the response to the client, ensuring that the response is properly formed XML. The entire URI, including the root parameter, can be controlled by the client, or in the case of cross-site scripting, a third-party attacker. The SQLXML HTTP components do not adequately validate the value of the root parameter. As a result, script or HTML included in a URI as part of the value of the root parameter will be executed by the web browser that accesses that URI. Microsoft Security Bulletin MS02-030 notes that SQLXML is installed but disabled by default. An IIS server is only vulnerable if SQLXML is enabled and configured to run over HTTP. For more information about cross-site scripting, see CERT Advisory CA-2000-02, the Malicious Web Scripts FAQ, and Cross-Site Scripting Vulnerabilities.","impact":"An attacker who can convince a user to access a URI supplied by the attacker could cause script or HTML of the attacker's choice to be executed in the user's browser. Using this technique, an attacker may be able to take actions with the privileges of the user who accessed the URI, such as issuing queries on the underlying SQL databases and viewing the results. In Microsoft Internet Explorer, malicious script or HTML would be executed in the same zone as the vulnerable IIS server. An SQLXML-enabled IIS server in the typically less restrictive Local intranet or Trusted sites zones would allow an attacker to bypas Internet zone security settings.","resolution":"Apply a Patch Apply the appropriate patch as described in Microsoft Security Bulletin MS02-030.","workarounds":"Disable Scripting To defend against cross-site scripting attacks from the client's perspective, disable scripting in your web browser and HTML-enabled email client. The zones feature of Microsoft Internet Explorer provides a way to selectively enable scripting for trusted sites. Instructions for disabling scripting can be found in the CERT/CC Malicious Web Scripts FAQ.","sysaffected":"","thanks":"The CERT/CC thanks both Matt Moore of Westpoint and Microsoft for information used in this document.","author":"This document was written by Art Manion.","public":["http://www.westpoint.ltd.uk/advisories/wp-02-0007.txt","http://www.microsoft.com/technet/security/bulletin/MS02-030.asp","http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xmlref/xmlref_7583.asp","http://www.securityfocus.com/bid/5005"],"cveids":["CVE-2002-0187"],"certadvisory":"CA-2000-02","uscerttechnicalalert":null,"datecreated":"2002-06-13T13:19:08Z","publicdate":"2002-06-12T00:00:00Z","datefirstpublished":"2002-06-25T22:59:12Z","dateupdated":"2002-08-08T19:28:20Z","revision":40,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"16","cam_exploitation":"0","cam_internetinfrastructure":"1","cam_population":"9","cam_impact":"13","cam_easeofexploitation":"12","cam_attackeraccessrequired":"20","cam_scorecurrent":"8.9505","cam_scorecurrentwidelyknown":"11.0565","cam_scorecurrentwidelyknownexploited":"21.5865","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":8.9505,"vulnote":null}