| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <200404220048.i3M0miG0073362@mailserver1.hushmail.com> From: shr3kst3r at hushmail.com (shr3kst3r@...hmail.com) Subject: pisg XSS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ========================================================================= = pisg XSS ========================================================================= pisg is an IRC channel statics generator written in Perl, it creates statistics from different logfile formats. It was originally written because IRCStats wasn't open source. So here's an open source/GPL'ed version to anyone interested. It's a funny thing for your IRC channel, and it's highly customizeable. PROBLEM: pisg does not sanitize the nick of the user before posting to the web PROOF: 1. silc 2. /connect silc.net 3. /nick <script>alert(document.domain);</script> 4. /log ... 5. /me a couple of times on a channel 6. /quit 3. then generate stats ./pisg 4. surf the index.html MORE INFO: The silc-client, which is an old irssi-client with the silc stuff patched on, logs in the irssi format which pisg reads, and also silcd allows strange names like the above "<script>alert(document.domain);</script>". But, the major problem is, pisg does not sanitize the nick. This problem does not occur when using irssi connected to a regular ircd because the ircd does not allow the nick. The "/me <stuff>" is required, a regular /msg <channel> will not work. FIX: Sanitize everything. OTHER PROBLEMS: Could not find a security@...g.net or anything ressembling it. I can't spell. This might affect a whole 3 people in the world. de14a09207f3f7af64a492b4d1cc0e49 2c8db6262817d6a6225d11437e503c7e -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkCHFmkACgkQQdPEZ+t83SAm6gCgg7kn7JohnyOwLQCA0EvahOZs/B8A oLQkIdqWByGXgLN0FERvG9AlHo35 =rZ/n -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427
Powered by blists - more mailing lists