This question already has an answer here:
- XSS via REQUEST_URI 2 answers
So I've been doing a red team exercise and one internal app echos back
Cannot find /whatever/your/path. Since this is not a PHP or even fully featured web server there is no magical automatic decoding so if you send in
/%00%0d%25/stuff you'll get
Cannot find /%00%0d%25/stuff
The issue is that every single browser in recent history either automatically encodes
> or is intelligent enough to not render the non-HTML page (since there's no HTML tags it interprets the string into a renderable context) as HTML. I've tested every browser that we currently have in operation and not a single one has generated an XSS condition because they either correctly encoded the URL and any parameters or escaped the non-HTML document so that it can be rendered as seemingly plaintext.
Am I right to assume that unless combined with another far more significant vulnerability this is unexploitable unless you happen to be running Netscape 1.0 or some other equally poor (and unapproved) browser?