bugMHonArc - Bugs: bug #12930, Cross site scripting bug in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #12930: Cross site scripting bug in m2h_text_html::filter

Submitter:  None
Submitted:  Mon 02 May 2005 04:26:47 AM UTC
   
 
Category:  MIME Filter Severity:  6 - Security
Priority:  5 - Normal Item Group:  Security
Status:  Fixed Privacy:  Public
Assigned to:  None Open/Closed:  Closed
Operating System:  All Perl Version:  All
Component Version:  2.36 Fixed Release:  2.6.11

Mon 02 May 2005 05:57:55 PM UTC, comment #1: 

mhtxthtml.pl has been updated in CVS to escape "vbscript" and
"ecmascript".

As for the other keywords, I'd like to have more information
on what browsers (or other software) support such scheme in
event handlers.

Earl Hood <ehood>
Group administrator
Mon 02 May 2005 04:26:47 AM UTC, original submission:  

There's a cross site scrpiting bug in m2h_text_html::filter.
An HTML email with the following data causes XSS:

<a href='/' style='background:url(vbscript:MsgBox("XSS
!!!"))'></a>

Notice that it bypasses the anti "javascript" trick of mhonarc (in which MHonArc will replace the "javascript" string with "_javascript_", effectively defanging the Javascript code)
simply by using the scheme "vbscript", not "javascript" (this of course limits the attack to IE clients and any other browser which supports the "vbscript" scheme).

MHonArc should look for (and defang) the following keywords:
"vbscript", "livescript", "lavascript", "ecmascript", "jscript", and "mocha".

Thanks,
-Amit Klein

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

 

Follow 6 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2005-05-20 ehood Perl Versionprobably all... All
    Fixed ReleaseCVS 2.6.11
2005-05-20 ehood Open/ClosedOpen Closed
2005-05-07 ehood Severity3 - Normal 6 - Security
2005-05-02 ehood StatusNone Fixed
    Fixed Release CVS

Back to the top

Powered by Savane 3.13-3230.
Corresponding source code