Re: XSS in HTDIG

From: Peter Watkins (peterwat_private)
Date: Thu Jun 27 2002 - 13:25:24 PDT

Next message: Henrik Edlund: "Re: XSS in HTDIG"

Previous message: Mihai (Cop) Moldovanu: "Re: Apache worm in the wild"
In reply to: Howard Yeend: "XSS in HTDIG"
Next in thread: Henrik Edlund: "Re: XSS in HTDIG"
Reply: Henrik Edlund: "Re: XSS in HTDIG"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, Jun 26, 2002 at 01:38:48AM -0700, Howard Yeend wrote:
> Eg;
> 
> http://www.anyhost.com/cgi-bin/htsearch.cgi?words=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E
> 
> (all URLS must be on one line)
> 
> Apologies if this is a known issue.
> Apologies also for posting about XSS, too, but
> this is not an isolated website, but a commonly
> used service.

Howard,

What version is this? With the sample templates in ht://Dig version 3.1.6,
the "words" info seems to be properly escaped -- I just see the <script>
stuff inside the text input box, and translated on the page. For example,

http://www.htdig.org/cgi-bin/htsearch?config=htdig;words=%22%3E%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E

My example URL suggests that version 3.1.5 is also immune, though 3.1.5
has other issues that 3.1.6 resolves -- see 
   http://online.securityfocus.com/bid/3410 and 
   http://www.htdig.org/index.html

-Peter
-- 
Peter Watkins - peterwat_private - peterwat_private - http://www.tux.org/~peterw/ 
Private personal mail: use PGP key F4F397A8; more sensitive data? Use 2D123692

Next message: Henrik Edlund: "Re: XSS in HTDIG"
Previous message: Mihai (Cop) Moldovanu: "Re: Apache worm in the wild"
In reply to: Howard Yeend: "XSS in HTDIG"
Next in thread: Henrik Edlund: "Re: XSS in HTDIG"
Reply: Henrik Edlund: "Re: XSS in HTDIG"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Fri Jun 28 2002 - 13:18:25 PDT