Numerous installations of Microsoft ASP.NET are vulnerable to cross-site scripting (CSS), according to a recent post by Johannes Westerink to the BugTraq mailing list.

CSS leverages JavaScript and makes it possible to place a malicious URL in an e-mail or on a Web site, which if followed will compromise the user's machine by various means, including exposing shares and/or retrieving data files such as cookies.

Examples discovered by Westerink include:

http://www.msn.com/~/&ltscript&gtalert(document.cookie)</script&gt.aspx?aspxerrorpath=null
http://my.msn.com/~/&ltscript&gtalert(document.cookie)</script&gt.aspx?aspxerrorpath=null
http://dotnet.microsoft.com/&ltscript&gtalert(document.cookie)</script&gt.aspx
http://terraserver.microsoft.net/&ltscript&gtalert(document.cookie)</script&gt.aspx
http://support.microsoft.com/~/&ltscript&gtalert(document.cookie)</script&gt.aspx?aspxerrorpath=null
http://office.microsoft.com/~/&ltscript&gtalert(document.cookie)</script&gt.aspx?aspxerrorpath=null
http://communities.microsoft.com/~/&ltscript&gtalert(document.cookie)</script&gt.aspx
http://uddi.microsoft.com/~/&ltscript&gtalert(document.cookie)</script&gt.aspx

Westerink says he contacted MS about the issue six months ago but never got a reply.

Meanwhile, Internet security and privacy consultant Richard M. Smith, who now maintains the site ComputerBytesMan.com, "checked in with Microsoft about this problem and was told that this is a known bug that was fixed in ASP.NET before the final software was shipped."

So MS got the message all right, but somehow neglected to mention it to anyone, or even thank Westerink for bringing it to their attention.

"The various Microsoft Web servers that still have the bug are running pre-release versions of ASP.NET," Smith adds. "It looks like Microsoft also has trouble keeping up with security patches and updates."

One hopes they'll have got this sorted by press time.... ®