BugTraq
CGI.pm vulnerable to Cross-site Scripting Jul 20 2003 10:06PM
obscure (dontreply eyeonsecurity org) (1 replies)
Re: CGI.pm vulnerable to Cross-site Scripting Jul 21 2003 07:36PM
Erwann CORVELLEC (Erwann Corvellec free fr) (1 replies)

Please find attached a more thorough patch against version 2.93 of CGI.pm

Lincoln, could you include it in an urgent security release please ?

Le 21/07/2003 00:06, obscure a écrit :

> Advisory Title: CGI.pm vulnerable to Cross-site Scripting.
> Release Date: July 19 2003
>
> Application: CGI.pm - which is by default included in many common Perl
> distributions.
>
>
> Platform: Most platforms. Tested on Apache and IIS.
>
> Version: CGI.pm
>
> Severity: Effects scripts which make use of start_form()
>
> Author:
> Obscure^
> [ obscure (at) eyeonsecurity (dot) org [email concealed] ]
>
> Vendor Status:
> first informed on 30th April 2003
> Although the author told EoS that he will be releasing a fix within a
> week from his last correspondence (May15), no fix is out yet on his
> website.
>
>
> Web:
>
> http://stein.cshl.org/WWW/software/CGI/
> http://eyeonsecurity.org/advisories/
>
>
> Background.
>
> (extracted from
> http://stein.cshl.org/WWW/software/CGI/)
>
> This perl 5 library uses objects to create Web fill-out forms on the fly
> and to parse their contents. It provides a simple interface for parsing
> and interpreting query strings passed to CGI scripts. However, it also
> offers a rich set of functions for creating fill-out forms. Instead of
> remembering the syntax for HTML form elements, you just make a series of
> perl function calls. An important fringe benefit of this is that the
> value of the previous query is used to initialize the form, so that the
> state of the form is preserved from invocation to invocation. .
>
>
> Problem
>
> CGI.pm has the ability to create forms by making use of the start_form()
> function. The developer/perl scripter can also makes use of
> start_multipart_form() which relies on start_form() and is therefore
> vulnerable to the same issue. When the action for the form is not
> specified, it is given the value of $self->url(-absolute=>1,-path=>1) -
> which means that when the url is something like the following :
>
> http://host/script.pl?">some%20text<!--%20
>
> .. the form becomes <form action="http://host/script.pl">some text<!-- "
>
>
> In such case, it is possible to exploit this issue to launch a Cross
> Site Scripting attack.
>
> Exploit Examples.
>
> --
> #!/usr/bin/perl
> # example of exploitable script
> #
>
> use CGI;
>
> $q = new CGI;
> print $q->header;
> print $q->start_html('CGI.pm XSS');
> print $q->start_form();
> print $q->end_form();
> print $q->end_html;
>
> --
>
> Fix.
>
> I fixed my CGI.pm by adding the following code at line 1537
>
> $action =~ s/\"/\%22/g;
>
>
> Disclaimer.
>
> The information within this document may change without notice. Use of
> this information constitutes acceptance for use in an AS IS
> condition. There are NO warranties with regard to this information.
> In no event shall the author be liable for any consequences whatsoever
> arising out of or in connection with the use or spread of this
> information. Any use of this information lays within the user's
> responsibility.
>
>
> Feedback.
>
> Please send suggestions, updates, and comments to:
>
> Eye on Security
> mail : obscure (at) eyeonsecurity (dot) org [email concealed]
> web : http://www.eyeonsecurity.org

[ reply ]
Re: CGI.pm vulnerable to Cross-site Scripting Jul 22 2003 04:57PM
Lincoln Stein (lstein cshl edu) (1 replies)
Re: CGI.pm vulnerable to Cross-site Scripting Jul 23 2003 08:20AM
Erwann CORVELLEC (Erwann Corvellec free fr)


 

Privacy Statement
Copyright 2010, SecurityFocus