full-disclosure - [bWM#012] Passing script/html-filter with special chars (multibrowser)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <27550198$10599115823f2cf79ec3f3e6.94963666@config18.schlund.de>
From: ben.moeckel at online.de (ben.moeckel@...ine.de)
Subject: [bWM#012] Passing script/html-filter with special chars (multibrowser)

badWebMasters security advisory #012 

Passing script/html-filter with special chars (multibrowser) 

Discovery date: 2003-07-16 

Update: 2003-07-31 

Original advisory:
http://badwebmasters.net/advisory/012/ (text/html) 

Legal Notice:
Copyright 2003 by Benjamin Klimmek (ben moeckel - badWebMasters)!
You may distribute it unmodified.
You may not modify it and distribute it or distribute parts of it
without giving credits and the URL where the original advisory can be
found!
This document may change without notice. 

Author:
ben moeckel (http://distressed.de)
mailto: badwebmasters@...ine.de 

Description:
When webbrowsers parse html they remove special chars, this behavior may
be used by an malicious user to fool script/html-filters in
webapplications.

Detail: 
badWebMasters showed in their advisory #011 how to pass the "Snitz
Forums"-scriptfilter with the Tab-Char (09). After "Opera" and
"Mozilla"-users noticed that the provided exploit didn't work on their
system I decided to start some new testings, with an amazing result!

To detect what kind of special chars can be used in html- parameters I
set up the following asp-page:

----------------------------------------test2.asp---------
<%@...GUAGE=JScript%><%

Response.BinaryWrite('<html><script>function a(o){alert(o)}</script>');
Response.BinaryWrite('<img src="javascript:a(\'test\')" />');
for(i=0;i<256;++i){
	uc = "%"+chk(i.toString(16));
	Response.BinaryWrite('<img src="ja'+unescape(uc)+'vascript:a('+i+')"
/>\r\n');
}
function chk(sInp){if(sInp.length<2){
	return String("0"+sInp)
}else{return sInp}}

%>
---------------------------------------------------------

Result:

The page has been viewed with Mozilla, Opera and Internet- Explorer, the
alert-box poped up in this order:

   Mozilla 1.3.1 (Win32): 	- (with restricions)

   Opera 7.11 (Win32): 		0, 9, 10, 13, 173

   Internet Explorer 5.0:	13, 10, 9, 0

Webmasters may be carefull with char 173 (ADh) that can be used in Opera
only.

Silly Internet Explorer: reversed order!?

Test:
http://badwebmasters.net/advisory/012/test.asp 

Workaround:
Make sure control-chars are removed before badwords are! Even better:
Only allow trusted protocols in user-images!

References:
[bWM #011]: Cross-Site-Scripting @ Snitz Forums
- http://cert.uni-stuttgart.de/archive/bugtraq/2003/04/msg00247.html 

Thanks:
Thanks to "jelmer " for correcting my demo page! 

Feedback:
Comments, suggestions, updates, anything else?
   -> mailto:badwebmasters@...ine.de 

__________________________________________

badWebMasters - ben moeckel security research
http://badwebmasters.de http://badwebmasters.net
copyright 2k1-3 by Benjamin Klimmek / Germany
mailto:badwebmasters@...ine.de