bugZoneCheck - Bugs: bug #29967, XSS threats

 
 

bug #29967: XSS threats

Submitted by:  None
Submitted on:  Wed 26 May 2010 12:30:50 PM UTC  
 
Category:  input Severity:  Critical
Priority:  9 - Immediate Item Group:  Crash/Error
Status:  Fixed Privacy:  Public
Assigned to:  Fabien CHABANNE <chabannf> Open/Closed:  Closed

Add a New Comment (Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 26 May 2010 03:27:30 PM UTC, comment #3: 
Fabien CHABANNE <chabannf>
Project MemberIn charge of this item.
Wed 26 May 2010 02:12:24 PM UTC, comment #2: 

The right solution is probably to wrap every output with escapeHTML.

http://ruby-doc.org/core/classes/CGI.html#M000548

Stephane Bortzmeyer <bortzmeyer>
Project Administrator
Wed 26 May 2010 01:57:07 PM UTC, comment #1: 

The original exploit uses the 'ns' parameter but the others are vulnerable as well (tested with 'zone'). No escape is done before writing the HTML.

Stephane Bortzmeyer <bortzmeyer>
Project Administrator
Wed 26 May 2010 12:30:50 PM UTC, original submission:  

http://www.xssed.com/mirror/61096/

http://www.afnic.fr/outils/zonecheck/zc.cgi?afnic=1&zone=garlinludovic.fr&ns0=francofolibre.org&ips0=88.191.24.9&ns1=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C/script%3E

or

http://www.zonecheck.fr/cgi-bin/zc-limited.cgi?zone=afnic.fr&ns0=ns1.xname.org%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&ips0=&ns1=&ips1=&ns2=&ips2=&ns3=&ips3=&ns4=&ips4=&ns5=&ips5=&ns6=&ips6=&ns7=&ips7=&intro=t&explain=t&details=t&progress=counter&report=byseverity&format=html&lang=fr&errorlvl=&profile=automatic&chkmail=t&chkzone=t&chkrir=t&transp3=ipv4&transp3=ipv6&transp4=std

Entered datas are not correctly escaped and fails against XSS exploits protection.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chabannf (Posted a comment)
  • -email is unavailable- added by bortzmeyer (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-06-22 chabannf Open/ClosedOpen => Closed
    2010-05-26 chabannf StatusConfirmed => Fixed
    2010-05-26 bortzmeyer SeverityHigh => Critical
        Priority5 - Normal => 9 - Immediate
        Item GroupAction request => Crash/Error
        StatusNone => Confirmed
        Assigned toNone => chabannf

    Back to the top


    Powered by Savane 3.7