4

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this:

<meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" />

It strips the < and > characters but not double quotes. However, since I cannot get rid of the other input, I cannot use 1;javascript:alert(1) or something similar.

Is this filter secure?

5

I definitely agree with thexacre about the ineffectiveness of blacklisting -- and not just because the answer referenced my website :).

Not being able to get rid of the beginning content portion can certainly limit the opportunity for successful XSS via a meta tag, though it's not entirely impossible. For example, if the beginning portion ever changes to begin with a non-numeric word such as "No results for..." you might be able to inject something like:

;url=hxxp://www.maliciousxss.com" HTTP-EQUIV="refresh" blah=" which, based on your description should result in a meta tag similar to:

<meta property="the:property" content="No results for;url=hxxp://www.maliciousxss.com" HTTP-EQUIV="refresh" blah=" (Page 1)" />

I successfully tested it in FF 29.0.1 but I don't believe this would work in any other modern browser.

If the beginning text always starts with a number you could try something like

" STYLE="width:expression(alert('XSS'));" blah="which again based on your example should result in a meta tag similar to:

<meta property="the:property" content="100 results for" STYLE="width:expression(alert('XSS'));" blah=" (Page 1)" />

This one would only work in IE 7 or earlier so it's even more limited.

I had to make some assumptions of site behavior and additional input validation so these particular examples may not work, but I hope I've helped support thexacre's statement that blacklisting is rarely a completely effective approach. Whitelisting (when possible) is better but output encoding is always a must whenever user-generated data is incorporated in the server response.

3

Off the top of my head and without seeing the page specifically I can't think of an attack vector, but "blacklisting" is rarely an completely effective security technique so I'd bet it isn't safe.

I found this article for example which specifically addresses meta tags: http://www.securitysift.com/quotes-and-xss-planning-your-escape/

As described in that article, you could inject a HTTP-EQUIV="refresh" and a base64 encoded URL to redirect the page.

  • I considered that. I could also use the javascript: protocol. Unfortunately, my input is sandwiched in between to other strings. I can get rid of the last part by ending with ` nothing="someval` but right now I don't know how to get rid of the beginning part. – 735Tesla Jun 1 '14 at 1:11
  • I'll give it a day or two, and if has any ideas, I'll accept your answer. – 735Tesla Jun 1 '14 at 1:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.