ZoneCheck - Bugs: bug #29967, XSS threats

Group

Main
- Main
- View members
- Search
Homepage
Download
Mailing lists
Source code
Bugs
- Submit new
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Tasks
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search
Patches
- ~~Submit new~~
- Browse
- Reset to open
- Digest
- Dependencies
- ~~Export~~
- Get statistics
- Search

bug #29967: XSS threats

Submitter:	None
Submitted:	Wed 26 May 2010 12:30:50 PM UTC


Category:	input	Severity:	Critical
Priority:	9 - Immediate	Item Group:	Crash/Error
Status:	Fixed	Privacy:	Public
Assigned to:	chabannf	Open/Closed:	Closed

* Mandatory Fields

Add a New Comment Rich Markup

Wed 26 May 2010 03:27:30 PM UTC, comment #3: Fixed in CVS. Diff of /zonecheck/zc/publisher/html.rb : http://cvs.savannah.gnu.org/viewvc/zonecheck/zc/publisher/html.rb?root=zonecheck&r1=1.79&r2=1.80	Fabien CHABANNE <chabannf>
Wed 26 May 2010 02:12:24 PM UTC, comment #2: The right solution is probably to wrap every output with escapeHTML. http://ruby-doc.org/core/classes/CGI.html#M000548	Stephane Bortzmeyer <bortzmeyer>
Wed 26 May 2010 01:57:07 PM UTC, comment #1: The original exploit uses the 'ns' parameter but the others are vulnerable as well (tested with 'zone'). No escape is done before writing the HTML.	Stephane Bortzmeyer <bortzmeyer>
Wed 26 May 2010 12:30:50 PM UTC, original submission: http://www.xssed.com/mirror/61096/ http://www.afnic.fr/outils/zonecheck/zc.cgi?afnic=1&zone=garlinludovic.fr&ns0=francofolibre.org&ips0=88.191.24.9&ns1=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C/script%3E or http://www.zonecheck.fr/cgi-bin/zc-limited.cgi?zone=afnic.fr&ns0=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&ips0=&ns1=&ips1=&ns2=&ips2=&ns3=&ips3=&ns4=&ips4=&ns5=&ips5=&ns6=&ips6=&ns7=&ips7=&intro=t&explain=t&details=t&progress=counter&report=byseverity&format=html&lang=fr&errorlvl=&profile=automatic&chkmail=t&chkzone=t&chkrir=t&transp3=ipv4&transp3=ipv6&transp4=std Entered datas are not correctly escaped and fails against XSS exploits protection.	Anonymous

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:


Comment:

No files currently attached

Depends on the following items: None found

Items that depend on this one: None found

Carbon-Copy List

-email is unavailable- added by chabannf (Posted a comment)

-email is unavailable- added by bortzmeyer (Posted a comment)

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

Please enter the title of George Orwell's famous dystopian book (it's a date):

Follow 7 latest changes.

Date	Changed by	Updated Field	Previous Value	Replaced by
2010-06-22	chabannf	Open/Closed	Open	Closed
2010-05-26	chabannf	Status	Confirmed	Fixed
2010-05-26	bortzmeyer	Severity	High	Critical
		Priority	5 - Normal	9 - Immediate
		Item Group	Action request	Crash/Error
		Status	None	Confirmed
		Assigned to	None	chabannf

ZoneCheck - Bugs: bug #29967, XSS threats

bug #29967: XSS threats

<a href="#postcomment">Post a Comment</a>

<a href="#discussion">Discussion</a>

<a href="#attached">Attached Files</a>

<a href="#dependencies">Dependencies</a>

<a href="#cc">Mail Notification Carbon-Copy List</a>

<a href="#votes">Votes</a>

<a href="#history">History</a>