Application validation on defensivethinking.com

[jamie fisher <contact_jamie_fisher () yahoo co uk>]

I've noticed some issues with respect to the way some of defensivethinking's web pages handle and validate (or rather 
not validate) scripts.

Link: http://defensivethinking.com/contact/submit.php

Parameter:  strFirstName=admin -> strFirstName=>"'><script>alert('Look mummy I'm on Big Kev's web site')</script>
Parameter:  strFirstName=admin -> 
strFirstName=>"'><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;This%26%23x20;-%26%23x20;web%26%23x20;site%26%23x20;is%26%23x20;XSS%26%23x20;vulnerable%26quot;)>
Parameter:  strFirstName=admin -> 
strFirstName=>%22%27><img%20src%3d%22javascript:alert(%27This%20-%20web%20site%20is%20XSS%20vulnerable%27)%22>

 

Impact:
Customer session and cookies are compromised. The attacker may be able to pose as a legitimate user to view and alter 
user records, and perform transactions as that user.

Test Description:
There are three parties involved in this attack:
(A) - is an attacker. He/she may know the identity of "B", and the structure of site "C".
(B) - is the victim user (of web-site "C").
(C) - is the vulnerable web-site.

The attack is basically a privacy violation. The attacker (A) gains the victim user (B)'s credentials at the vulnerable 
site (C). When the site involved is vulnerable, it is possible to steal credentials from its users. It is not possible 
to gain information regarding other sites, so (C)'s vulnerability affects only (C)'s customers.

The attack hinges on the fact that the web-site (C) has a script that returns user input (usually a parameter value, 
but variants are discussed below) in an HTML page without first sanitizing the input. This allows an input consisting 
of JavaScript code to be executed by the browser when the script returns this input in the response page. As a result 
it is possible to form links to the site (C) where one of the parameters consists of malicious JavaScript code. This 
code will be executed (by (B)'s browser) in (C) site context, granting it access to cookies (B) has for site (C), and 
other windows in site (C) at browser (B).
The attack proceeds as following: The attacker (A) lures the legitimate user (B) to click on a link that was produced 
by the attacker. When the user clicks on the link, this generates a request to the web-site (C) containing a parameter 
value with malicious JavaScript code. If the web-site (C) embeds this parameter value into the response HTML page (this 
is the essence of the site vulnerability), the malicious code will run in the user's browser (B).

Possible actions that can be performed by the script are:
[1] Sending the attacker the user cookies for the legitimate site
[2] Sending the attacker the current URLs of the legitimate site in which the user has an open window
This information is sent to the attacker (A), and thus the victim user "C"'s security (privacy) is compromised.

Some notes:
[1] Although the attacked web-site (C) is involved, it is not in itself compromised (in the narrow sense). It is only 
used as a jump station for the malicious script (sent by the attacker) to return to the victim's browser (B) as if it 
is legitimate. However, since the privacy of the victim (B) is breached in the context of site (C), and since site (C) 
is directly responsible, it is considered a security flaw in site (C) (much like a weak session token would have been).
[2] The malicious link can be provided by (A) by via a web-site link (if (A) maintains a site that is visited by (B)), 
or via email (if (A) knows (B)'s email address, and if (B)'s email client uses the browser to render the HTML message).
[3] While user input is most commonly found in form field values (i.e. URL parameters), there are known attacks where 
the malicious code is embedded in the path, or in the HTTP Referer headers, and even in cookies.


Fix Recommendation
Sanitise user input and filter JavaScript code.  Filter the following characters: < > " ' % ; ) ( & +

Response from defensivethinking.com and Kevin Mitnick:

No response received.

I don't think Kevin and I are friends any more.

Hi to the Vodalads - except Lee Power who couldn't secure a personality.


References And Relevant Links
CERT Advisory CA-2000-02
     http://www.cert.org/advisories/CA-2000-02.html

Microsoft HOWTO: Prevent Cross-Site Scripting Security Issues (Q252985)
     http://support.microsoft.com/default.aspx?scid=kb;EN-US;q252985

Microsoft Technet "Cross-site Scripting Overview"
     http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/topics/csoverv.asp


                
---------------------------------
 ALL-NEW Yahoo! Messenger - all new features - even more fun!