full-disclosure - pisg XSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200404220048.i3M0miG0073362@mailserver1.hushmail.com>
From: shr3kst3r at hushmail.com (shr3kst3r@...hmail.com)
Subject: pisg XSS

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=========================================================================
= pisg XSS
=========================================================================

pisg is an IRC channel statics generator written in Perl, it creates
statistics from different logfile formats. It was originally written
because IRCStats wasn't open source. So here's an open source/GPL'ed
version to anyone interested. It's a funny thing for your IRC channel,
 and it's highly customizeable.

PROBLEM:
pisg does not sanitize the nick of the user before posting to the web

PROOF:
1. silc
2. /connect silc.net
3. /nick <script>alert(document.domain);</script>
4. /log ...
5. /me a couple of times on a channel
6. /quit
3. then generate stats ./pisg
4. surf the index.html

MORE INFO:
The silc-client, which is an old irssi-client with the silc stuff patched
on, logs in the irssi format which pisg reads, and also silcd allows
strange names like the above "<script>alert(document.domain);</script>".
 But, the major problem is, pisg does not sanitize the nick.  This problem
does not occur when using irssi connected to a regular ircd because the
ircd does not allow the nick.  The "/me <stuff>" is required, a regular
/msg <channel> will
not work.

FIX:
Sanitize everything.

OTHER PROBLEMS:
Could not find a security@...g.net or anything ressembling it.
I can't spell.
This might affect a whole 3 people in the world.

de14a09207f3f7af64a492b4d1cc0e49
2c8db6262817d6a6225d11437e503c7e
-----BEGIN PGP SIGNATURE-----
Note: This signature can be verified at https://www.hushtools.com/verify
Version: Hush 2.4

wkYEARECAAYFAkCHFmkACgkQQdPEZ+t83SAm6gCgg7kn7JohnyOwLQCA0EvahOZs/B8A
oLQkIdqWByGXgLN0FERvG9AlHo35
=rZ/n
-----END PGP SIGNATURE-----

Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
https://www.hushmail.com/services.php?subloc=messenger&l=434

Promote security and make money with the Hushmail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427