Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There is a web application which contains a search function. When I search for aaaaaaaaxss I get this:
<meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" />
It strips the < and > characters but not double quotes. However, since I cannot get rid of the other input, I cannot use 1;javascript:alert(1) or something similar.
Is this filter secure?
I definitely agree with thexacre about the ineffectiveness of blacklisting -- and not just because the answer referenced my website :).
Not being able to get rid of the beginning content portion can certainly limit the opportunity for successful XSS via a meta tag, though it's not entirely impossible. For example, if the beginning portion ever changes to begin with a non-numeric word such as "No results for..." you might be able to inject something like:
;url=hxxp://www.maliciousxss.com" HTTP-EQUIV="refresh" blah=" which, based on your description should result in a meta tag similar to:
<meta property="the:property" content="No results for;url=hxxp://www.maliciousxss.com" HTTP-EQUIV="refresh" blah=" (Page 1)" />
I successfully tested it in FF 29.0.1 but I don't believe this would work in any other modern browser.
If the beginning text always starts with a number you could try something like
" STYLE="width:expression(alert('XSS'));" blah="which again based on your example should result in a meta tag similar to:
<meta property="the:property" content="100 results for" STYLE="width:expression(alert('XSS'));" blah=" (Page 1)" />
This one would only work in IE 7 or earlier so it's even more limited.
I had to make some assumptions of site behavior and additional input validation so these particular examples may not work, but I hope I've helped support thexacre's statement that blacklisting is rarely a completely effective approach. Whitelisting (when possible) is better but output encoding is always a must whenever user-generated data is incorporated in the server response.
Off the top of my head and without seeing the page specifically I can't think of an attack vector, but "blacklisting" is rarely an completely effective security technique so I'd bet it isn't safe.
I found this article for example which specifically addresses meta tags: http://www.securitysift.com/quotes-and-xss-planning-your-escape/
As described in that article, you could inject a HTTP-EQUIV="refresh" and a base64 encoded URL to redirect the page.
javascript: protocol. Unfortunately, my input is sandwiched in between to other strings. I can get rid of the last part by ending with ` nothing="someval` but right now I don't know how to get rid of the beginning part.
– 735Tesla
Jun 1 '14 at 1:11
