5

Recently, I have come across a reported XSS where the attacker is Unicode encoding the payload in HTTP GET parameters to evade existing XSS filter -

POC

My question is - when does the Server/application convert the Unicode to plain text? Is it upon reading the values of GET parameters? If yes, then why not the filter is able to detect it?

The attack is not working, when the same payload is provided in plaintext. App is deployed on IIS 7.

Any mitigation strategy for this type of evasion technique will also be appriciated.

UPDATE: https://www.ietf.org/rfc/rfc1738.txt restricts the use of unicode chars as URLs. what are the chances that IIS 7 still accepts unicode chars as part of URL GET values. I have some vulnerable php webapps for testing (DVWA, deployed in WAMP server) which are easily vulnerable to very simple XSS attack vectors like <script>alert(1)</script>. I tried replacing few characters with their Unicode equivalent but that encoded string doesn’t invoke XSS!!!

  • will the server ever "convert the Unicode to plain text"? Simply filtering %u00 can stop it. Since non-english users won't encode chars all weird like that, nobody should miss the un-escaped fall-throughs. – dandavis Mar 23 '17 at 6:58
1

Use the package AntiXssEncoder of Nuget with:

Install-Package AntiXSS -Version 4.3.0

This Class has diferents encoders for each case in that this values is reflected, for example css, JavaScript, HTML, and URL; Use this methods depend on your case, for example:

In CSS use: CssEncode("data")
In Javascript use: JavaScriptStringEncode("data")

This solucion allow validate of major types for bypass the encoding, assurance to \u0027, %27 and much diferents options.

Other way is first normalize and encode the data, this allow validate for example, %u0027, \x00,%00 and change the value to specific language for evading bypass a validation.

https://msdn.microsoft.com/en-us/library/system.web.security.antixss.antixssencoder(v=vs.110).aspx https://msdn.microsoft.com/es-es/library/ebza6ck1(v=vs.110).aspx

I hope that I help you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.