2

I'm going through a vulnerability remediation exercise for a client and am trying to figure out how to best mitigate this particular hole. There's a script on our site that calls up content into a new window using <%= %>. Essentially this takes a hard-coded link in an include file looking something like 

<a href="/path/to/script?x=/path/to/linked/thing.img" target="">link</a>

and displays it on the resulting page within html using a script looking something like:

<img src="<% =request.querystring("x") %>">

This script is in hundreds of includes, so I'm trying to figure out the most efficient way of mitigating it. Should I use a find and replace to remove the script from the include files or is there a way to sanitize the actual script using something other than <%= %>?

The whole thing is legacy, super clunky and needs to be replaced anyway, but like I said, we're talking about hundreds of files here, and not all follow the same syntax so I can't run a batch find and replace for all of them. It'll have to be in small batches and I'll still have to go into each one to check if something broke. Kill me now.

I'm a designer/front-end dev, not a security expert (and not a JavaScript whiz either), so any help here would be much appreciated.

Improve this question
6
  • Is this classic ASP? ASP.NET?
    – Xander
    Mar 28, 2013 at 18:49
  • Not sure but want to say asp.net
    – kristina childs
    Mar 28, 2013 at 18:59
  • Do you know what the page extensions are? Are they .asp, or .aspx, or something else, perhaps?
    – Xander
    Mar 28, 2013 at 19:07
  • Any asp files are simply .asp. Does this matter in this context, though? ASP isn't the only language running on this particular server. It's an amalgamation of things... a total mess really. Keeps me employed though, so I'm not complaining ;)
    – kristina childs
    Mar 28, 2013 at 19:14
  • It matters because it determines what you have available in terms of specific technical mitigation options, nothing more.
    – Xander
    Mar 28, 2013 at 19:17

1 Answer 1

Reset to default
1

A simple way would be to create a white-list of characters, such as alphanumerical and forward slashes - and making sure the file exist on your local filesystem. You want to avoid having: <img src="javascript:..."> and such.

For this, I'd recommend making a function say sanitize() which filters out unwanted characters, and wrap each of these with it

<img src="<% =sanitize(request.querystring("x")) >">

Depending on your framework being used (ASP, Ruby, ...) maybe you could monkey patch the code, so that request.querystring() always returns a sanitized version.

Improve this answer
1
  • I like the idea of a sanitization function. Should I be looking at something like Google Caja or is there a simpler method for this?
    – kristina childs
    Mar 28, 2013 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .