Cross Site Scripting issue?

[purple]

Hi

We are being told that our site is vunerable to a cross site scripting attack by doing the following

http://www.oursite.com/cgi-bin/ca000001.pl

This is the injection:

'")<iframe src="http://google.com"></iframe>


Now I do not fully understand this and am trying to find out if this is "standard actinic" or a genuine site issue due to the way we have built it?

We are running v703 but are going to v8 very soon.

[Toby B]

Hi John,

Could you please provide a bit more info?

The URL posted is quite standard for Actinic. It's running the cart script for functions like adding to basket or viewing the cart.

This is the injection:

'")<iframe src="http://google.com"></iframe>

Where is this code coming from?

[purple]

Hi Toby

This is what Scanalert is finding and telling us proves the site is vulnerable to this type of attack. I can see this on our site with google content!! What I need to know is either how to explain to Scanalert that this is not an issue or how best to resolve this if it is.

http://www.oursite.com/cgi-bin/ss000...3C%2Fiframe%3E

[leehack]

Surely that is Google includes then not Actinic? None of the links you have provided show us anything. Have you got a live url so that we can see a problem page?

[kgeals]

To ensure google/other search egines don't index this page/script why don't you add it to the robots.txt file under Disallow:

ta,

Kevin.
www.herbsscotland.co.uk

[purple]

You can see the effect by (as I have done) by adding the following to an actinic site via the browser address bar, www.site.com plus text below, I just tried this on 4 sites picked at random and the same happened on each. Scanalert are therefore claiming tht this is a serious issue, trouble is I do not understand enough to dispute this if it is not an issue!

/cgi-bin/ss000001.pl?SECTIONID=%27%22%3E%3Ciframe+src%3D%22http%3A%2F%2Fgoogle.com%22%3E%3C%2Fiframe%3E

[RuralWeb]

Read all about it here http://en.wikipedia.org/wiki/Cross_site_scripting

[mark0x]

It is an XSS issue, you can fix it by adding the following to actinic.pm:

find this:

($value =~ /\<script(\s*?|\s.*?)\>.+?/si))) || # reject <script>* and <script *>*

change it to this:

($value =~ /\<script(\s*?|\s.*?)\>.+?/si) ||
($value =~ /\<iframe(\s*?|\s.*?)\>.+?/si)))

although this is not really a great fix as other elements can be used for XSS such as img, etc.

[mark0x]

I forgot to mention, v8.5 is also vulnerable

[RuralWeb]

Its been arround for a while http://xforce.iss.net/xforce/xfdb/8180

[purple]

Thanks to all for help. I have amended as Mark0x suggested and the alerts are still suggesting that ss000001.pl, bb000001.pl & ca000001.pl are vulnerable with the same issue. I have also raised with Actinic and am rather frustrated at the lack of response other than suggesting upgrading to v7.07 but not confirming the issue exists or has even been resolved in V8 onwards.

[Bruce]

John,

The issue does exist in v7 and has been sorted with v8.0.4 and above.

Kind regards,

[purple]

Hi Bruce

We have upgraded to v851 and I can confirm the issues have not been resolved!

[keyboardsleeper]

Cross Site Scripting (XSS)

Has anyone found a proper solution for this in v7 ?
We do not want to upgrade to a new version, we want to resolve it in v7.

This is a serious issue and should have been addressed.
Ecommerce and security are the same thing.

We have just started ScanAlert (because it increase sales).
However, this error now prevents us from displaying their logo and getting any benefit.

[NormanRouxel]

and has been sorted with v8.0.4 and above

With 8.5.1.0.0.0.HFUA I can still do e.g.

http://www.mysite.com/cgi-bin/ca000001.pl?<script>alert(unescape(document.cookie))</script>

Or shop on the Actinic demo site then try

http://www.actinic.co.uk/cgi-bin/ca0...kie))</script>

Note to Actinic: Delete this post if you wish.