Software Engineering Institute

The Apache mod_proxy_ftp module allows the Apache web server to act as a proxy for FTP sites. Filename globbing is the process of using wildcards to match filenames. The mod_proxy_ftp module contains an XSS vulnerability that occurs because the module does not properly filter globbed characters in FTP URIs.

A remote attacker may be able to execute arbitrary Javascript in the context of a site being proxied by the Apache server.

Upgrade

Apache has released updates to address this issue. These updates are available on the Apache SVN server:
http://svn.apache.org/viewvc?view=rev&revision=682868
http://svn.apache.org/viewvc?view=rev&revision=682870
http://svn.apache.org/viewvc?view=rev&revision=682871

Note that vendors who distribute Apache may not have immediately have a version or update that contains these fixes.

Workarounds

• Mozilla Firefox users can use the NoScript extension to keep Javascript from running in untrusted domains.
• Application firewalls and IPS systems may be able to block certain types of XSS attacks at the network perimeter.