CVE-2008-0455

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the mod_negotiation module of Apache HTTP Server versions 2.2.6 and earlier (2.2.x series), 2.0.61 and earlier (2.0.x series), and 1.3.39 and earlier (1.3.x series). When a remote authenticated user uploads a file whose name contains XSS sequences and a file extension, and another user requests the file without the extension, the server may return a 406 Not Acceptable or 300 Multiple Choices HTTP response that reflects the malicious filename, injecting arbitrary web script or HTML.

Exploitation

An attacker must have valid credentials to upload a file to a location served by Apache with mod_negotiation enabled. The attacker uploads a file with a name such as .txt. When a victim requests the file without the extension (e.g., /path/), the server's negotiation process triggers a 406 or 300 response that includes the unsanitized filename in the HTTP body, causing the browser to execute the injected script.

Impact

Successful exploitation allows an attacker to inject arbitrary web script or HTML into the response page. This can lead to session hijacking, credential theft, or defacement, all within the security context of the affected Apache server domain. The attack requires the victim to visit a crafted URL and the server to have mod_negotiation enabled.

Mitigation

Apache HTTP Server versions 2.2.7, 2.0.62, and 1.3.40 contain patches that properly sanitize filenames in negotiation responses. Users should upgrade to these or later versions. Workarounds include disabling mod_negotiation if not required, or restricting file upload capabilities for authenticated users. No mention of this CVE in the provided Red Hat advisories [1][2][3][4] indicates that patches were shipped separately.