bugZoneCheck - Bugs: bug #29967, XSS threats

 
 

bug #29967: XSS threats

Submitted by:  None
Submitted on:  Wed 26 May 2010 12:30:50 PM UTC  
 
Category: inputSeverity: Critical
Priority: 9 - ImmediateItem Group: Crash/Error
Status: FixedPrivacy: Public
Assigned to: Fabien CHABANNE <chabannf>Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 26 May 2010 03:27:30 PM UTC, comment #3:

Fixed in CVS.

Diff of /zonecheck/zc/publisher/html.rb :
http://cvs.savannah.gnu.org/viewvc/zonecheck/zc/publisher/html.rb?root=zonecheck&r1=1.79&r2=1.80

Fabien CHABANNE <chabannf>
Project MemberIn charge of this item.
Wed 26 May 2010 02:12:24 PM UTC, comment #2:

The right solution is probably to wrap every output with escapeHTML.

http://ruby-doc.org/core/classes/CGI.html#M000548

Stephane Bortzmeyer <bortzmeyer>
Project Administrator
Wed 26 May 2010 01:57:07 PM UTC, comment #1:

The original exploit uses the 'ns' parameter but the others are vulnerable as well (tested with 'zone'). No escape is done before writing the HTML.

Stephane Bortzmeyer <bortzmeyer>
Project Administrator
Wed 26 May 2010 12:30:50 PM UTC, original submission:

http://www.xssed.com/mirror/61096/

http://www.afnic.fr/outils/zonecheck/zc.cgi?afnic=1&zone=garlinludovic.fr&ns0=francofolibre.org&ips0=88.191.24.9&ns1=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C/script%3E

or

http://www.zonecheck.fr/cgi-bin/zc-limited.cgi?zone=afnic.fr&ns0=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&ips0=&ns1=&ips1=&ns2=&ips2=&ns3=&ips3=&ns4=&ips4=&ns5=&ips5=&ns6=&ips6=&ns7=&ips7=&intro=t&explain=t&details=t&progress=counter&report=byseverity&format=html&lang=fr&errorlvl=&profile=automatic&chkmail=t&chkzone=t&chkrir=t&transp3=ipv4&transp3=ipv6&transp4=std

Entered datas are not correctly escaped and fails against XSS exploits protection.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by chabannf (Posted a comment)
  • -unavailable- added by bortzmeyer (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 22 Jun 2010 02:02:02 PM UTCchabannfOpen/ClosedOpen=>Closed
    Wed 26 May 2010 03:27:45 PM UTCchabannfStatusConfirmed=>Fixed
    Wed 26 May 2010 01:57:07 PM UTCbortzmeyerSeverityHigh=>Critical
      Priority5 - Normal=>9 - Immediate
      Item GroupAction request=>Crash/Error
      StatusNone=>Confirmed
      Assigned toNone=>chabannf

    Back to the top


    Powered by Savane 3.1-cleanup1