Thunderstone Support Forums

Following error message occurs for the link http://{websitename}/texis”

404 Not Found
The requested URL '/texis"' was not found on this server.

Is there a fix or workaround?

Is this a new Webinator install that TexisISAPI isn't functioning with?
What OS is this on?

Are there any entries in the event log?

I don't see what Cross Site Scripting has to do with it.

OS: W2K
New webinator install and Texis ISAPI is functioning.

Adding html code at the end indicates cross site scripting vulnerability. For example, http://websitename/texis<Script>alert('XSS');</script>

When searched for the error message text, “The requested URL '%.80s' was not found on this server” was found in moniter.exe/texis.exe

> New webinator install and Texis ISAPI is functioning.

This means that everything's ok if you request /texis/webintor/dowalk or /texis/webinator/search, yes?

> Adding html code at the end indicates cross site
> scripting vulnerability. For example,
> http://websitename/texis<Script>alert('XSS');</script>

I don't see any indication of a vulnerability. Trying the example you provided didn't execute the code, but produced the expected 404:

The requested URL '/texis<script>alert('xss');</script>'
was not found on this server.

> When searched for the error message text, “The
> requested URL '%.80s' was not found on this server”
> was found in moniter.exe/texis.exe

What does "The requested URL '%.80s' was not found on this server" being in the executables have to do with a vulnerability?

The `%.80s' string is used to print the URL for 404 errors, but without escapement. Since the URL comes from the user, <script> code could be added to it to cause the server to send an arbitrary script.

This issue applies to the Texis Monitor web server, which is used if you installed the Windows version of Webinator with the Texis ISAPI filter. If you have a maintenance contract with Thunderstone, contact us about an upgrade to address this issue. In the meantime, a hotfix can be applied with the following procedure:

1) Stop all Webinator crawls.

2) cd to your Texis/Webinator executable dir (the dir with monitor.exe, eg. c:\morph3)

3) Back up the executable:
copy monitor.exe monitor-org.exe

4) Copy the following 16-line script to an ASCII text file named fix. Be sure to copy it *exactly*:

<script language=vortex>
<timeout=-1></timeout>
<a name=main>
<vxcp htmlmode off>
<read "monitor-org.exe">
<if "" eq $ret>Error: Could not read file<exit 1></if>
<strfmt "%U" $ret>
<sandr ">>\+method\+%60\P=%25s" "%25H" $ret>
<sandr ">>\+method\+%27\P=%25s" "%25H" $ret>
<sandr ">>\+syntax%3A\+\P=%25s" "%25H" $ret>
<sandr ">>\+URL\+%27\P=%25\.80s" "%25.80H" $ret>
<sandr ">>\+URL\+is\+%27\P=%25s" "%25H" $ret>
<write "monitor-fix.exe"><fmt "%!U" $ret></write>
Patches applied.
</a>
</script>

6) Apply the patches to create monitor-fix.exe by running the script:
texis fix
This should create monitor-fix.exe. There should be no error messages printed. The resulting monitor-fix.exe will be the same size as monitor-org.exe.

7) Stop the Texis Monitor Service (or run monitor -k to do so from the command line). This will allow monitor.exe to be replaced.

8) Propagate the patched executable:
copy /y monitor-fix.exe texis.exe
copy /y monitor-fix.exe monitor.exe

9) Re-start the Texis Monitor web service, or from the command line:
start /B monitor

Thanks Kai! We tried to run the steps listed, however we got the error message at step #6.
The error msg was: ”Couldn’t open monitor.exe: Permission denied in the function do write patches applied”. We stopped the monitor service before running the fix. We noticed from task manager under processes that monitor.exe is running again immediately when we run “texis fix”. Appreciate any further suggestions! Thanks!

Ah, yes, my fault. Change "monitor.exe" to "monitor-fix.exe" in the script (both instances). Then copy monitor-org.exe to monitor-fix.exe, and re-run the script. Then copy monitor-fix.exe to texis.exe (in step 7). (I've edited my message #5 to reflect these changes.)

And one more step: After patching and copying monitor-fix.exe to texis.exe, stop the monitor service again (or monitor -k) and copy monitor-fix.exe to monitor.exe.

Fix has been applied and is working. Thanks Kai!