Cross-site scripting (XSS) vulnerability in list.cgi in the Icecast internal web server (icecast-server) 1.3.12 and earlier allows remote attackers to inject arbitrary web script via the UserAgent parameter.

Caused by improper filtering of HTML code in the status display, it is possible for a remote user to execute scripting code in the target user's browser.

Markus Worle discovered a cross site scripting problem in status-display (list.cgi) of the icecast internal webserver, an MPEG layer III streaming server. The UserAgent variable is not properly html_escaped so that an attacker could cause the client to execute arbitrary Java script commands.

The remote server runs a version of Icecast that is as old or older than version 1.3.12.

This version is affected by a cross-site scripting vulnerability in the status display functionality. This issue is due to a failure of the application to properly sanitize user-supplied input.

As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. 

This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

The remote host is running a vulnerable version of Icecast, an open-source streaming server. It is reported that every version of the 1.3 branch is vulnerable to a cross scripting issue. An attacker may steal cookie-based authentication credentials from a legitimate user by sending malformed links to the Icecast server.

ID	Name	Product	Family	Severity
36617	FreeBSD : icecast -- XSS Vulnerability (b2cfb400-1df0-11d9-a859-0050fc56d258)	Nessus	FreeBSD Local Security Checks	medium
15378	Debian DSA-541-1 : icecast-server - missing escape	Nessus	Debian Local Security Checks	medium
14390	Icecast list.cgi User-Agent XSS	Nessus	CGI abuses : XSS	medium
2136	Icecast list.cgi User-Agent XSS	Nessus Network Monitor	Web Servers	low

Detections

Analytics

CVE-2004-0781

medium

Tenable Plugins

medium

medium

medium

low