bugMHonArc - Bugs: bug #12930, Cross site scripting bug in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #12930: Cross site scripting bug in m2h_text_html::filter

Submitted by:  None
Submitted on:  Mon 02 May 2005 04:26:47 AM UTC  
 
Category: MIME FilterSeverity: 6 - Security
Priority: 5 - NormalItem Group: Security
Status: FixedPrivacy: Public
Assigned to: NoneOpen/Closed: Closed
Operating System: AllPerl Version: All
Component Version: 2.36Fixed Release: 2.6.11

Mon 02 May 2005 05:57:55 PM UTC, comment #1:

mhtxthtml.pl has been updated in CVS to escape "vbscript" and
"ecmascript".

As for the other keywords, I'd like to have more information
on what browsers (or other software) support such scheme in
event handlers.

Earl Hood <ehood>
Project Administrator
Mon 02 May 2005 04:26:47 AM UTC, original submission:

There's a cross site scrpiting bug in m2h_text_html::filter.
An HTML email with the following data causes XSS:

<a href='/' style='background:url(vbscript:MsgBox("XSS
!!!"))'></a>

Notice that it bypasses the anti "javascript" trick of mhonarc (in which MHonArc will replace the "javascript" string with "_javascript_", effectively defanging the Javascript code)
simply by using the scheme "vbscript", not "javascript" (this of course limits the attack to IE clients and any other browser which supports the "vbscript" scheme).

MHonArc should look for (and defang) the following keywords:
"vbscript", "livescript", "lavascript", "ecmascript", "jscript", and "mocha".

Thanks,
-Amit Klein

Anonymous

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 6 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Fri 20 May 2005 04:13:05 PM UTCehoodPerl Versionprobably all...=>All
  Fixed ReleaseCVS=>2.6.11
Fri 20 May 2005 04:13:04 PM UTCehoodOpen/ClosedOpen=>Closed
Sat 07 May 2005 04:43:41 AM UTCehoodSeverity3 - Normal=>6 - Security
Mon 02 May 2005 05:58:29 PM UTCehoodStatusNone=>Fixed
  Fixed Release=>CVS

Back to the top


Powered by Savane 3.1-cleanup1