I am currently pentesting a site for a client of mine and I found a very strange 'bug'.
They have a search box on the home page which if I enter te\tst
and hit search, it redirects to the search results page (not via ajax), and in the title it shows the keywords which I searched for, however, the control character actually gets executed.
So the title tag says this: "te st | site name"
<-- Executed the \t and created 4 spaces.
So my questions really are:
- Could this be classed as a potential vulnerability?
- Is there anyway that this can be exploited?
Thanks!
[Edit]
Just FYI, it does also execute other control-characters not just the tab. I just tried \r\n and it new-lined it.
Also, it only executes the control characters if they are encapsulated within other characters, so:
\r\n
doesn't work
te\r\nst
will return te[new line]st
search.matches("[\w]+")
rather thansearch.matches("^[\w]+$")
. As to whether this is exploitable, I'm unsure - it would depend on what other functions the search term is passed through.POST
ed to the results page, where it is filtered and used (The definition of used will lead to whether or not this is exploitable). The regex I posted was to explain your very last point about needing 'normal' chars surrounding the control chars.