Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My question is three-fold.

Background

I was asked to do some vulnerability scans on a website with some holes (I think). On a particular page, I was able to escape the text field and write on the site. If I left the site, the text I entered left.

Questions

1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))?

2) Is the fact that the text is non-persistant relevant? I can still put a script tag in there and it seems to run.

3) This one, I don't know if I can really expect to be answered; but, I lack imagination as to what I can do with this "hole." If I can run a script, I should be able to do something, but I don't think I know enough java script for that. What can be done (not really looking for code... necessarily...) with this?

share|improve this question

2 Answers 2

up vote 6 down vote accepted

1) How can I recommend a text field be secured (as far as validating input prior to be accepted to the html parser (which I learned runs before any of the other parsers))?

See https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet for information on how to prevent cross-site scripting (XSS). You will need to do data validation on the server to make sure only permitted characters are submitted, and you will need to do output encoding (e.g., most likely HTML entity encoding, but see the previous link for specifics) prior to returning the data to the browser.

2) Is the fact that the text is non-persistant relevant? I can still put a script tag in there and it seems to run.

"Reflected" XSS and "DOM-based" XSS is usually not considered to be as dangerous as "persistent" XSS, although the popularity of the site, the effectiveness of phishing/tricks by the attacker, and so on, have a big impact on how serious a reflected XSS attack truly is.

3) This one, I don't know if I can really expect to be answered; but, I lack imagination as to what I can do with this "hole." If I can run a script, I should be able to do something, but I don't think I know enough java script for that. What can be done (not really looking for code... necessarily...) with this?

Stealing keystrokes, hijacking sessions, duping users into installing malware, changing the look and feel of a site, redirecting people to sites that look the same but are actually attack sites, etc. See http://www.zdnet.com/blog/security/obama-site-hacked-redirected-to-hillary-clinton/1042 for a simple real world example.

share|improve this answer
    
Thanks for the detailed answer. The site isn't that popular right now, but with all the marketing they are doing, it may become more popular. Plus they definitly have people angry at them. –  Jeff Feb 4 '12 at 19:40
    
I wanted to add on to the severity of this (maybe someone could comment on this as well). I am trying to convince the older non-technical people this is a liability for them. If someone were to upload illegal files onto our host, we become liable for this. Anyone know what the severity of this could be? –  Jeff Feb 6 '12 at 15:27

I'll attempt to answer your question. So, if I understand your question correctly, you are able to inject HTML and Javascript, but it is only accessible to yourself? If this is the case, it is still potentially problematic as there might be a case where data from GET variables, child frames, parent frames, local storage, or anywhere else which might be malicious could inject itself or other javascript into the open page, thereby potentially causing more damage to you. This could possibly be with clickjacking, drive-by-downloads, etc...

As far as recommendations for rectifying this vulnerability, it is a bit difficult because there would have to necessarily be javascript validation, possibly with the onchange event, or onblur event. However, one can never really rely on Javascript for anything security related, as it is so easily disabled or altered.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.