full-disclosure - CodeIgniter Global XSS Filtering Bypass Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 27 Jul 2009 22:23:09 +0630
From: "YGN Ethical Hacker Group (http://yehg.net)" <lists@...g.net>
To: full-disclosure@...ts.grok.org.uk
Subject: CodeIgniter Global XSS Filtering Bypass
	Vulnerability

========================================

CodeIgniter Global XSS Filtering Bypass Vulnerability

========================================

Discovered by:
Aung Khant, YGN Ethical Hacker Group, Myanmar
http://yehg.net/ ~ believe in full disclosure

Product : CodeIgniter < http://www.codeigniter.com>
Product Description : Open-source PHP Framework
Pen-Tested Version : 1.5.2
Vulnerability : User-Agent injection
Risk : Medium
Threat : XSS, Log File Tampering

Advisory URL: http://yehg.net/lab/pr0js/view.php/CodeIgniter%20Global%20XSS%20Filtering%20Bypass%20Vulnerability.pdf

Description:
$CI->input->user_agent() fails to check the validity of user-agent type.
It simply extracts from $_SERVER array without checking whether it is
bad string injection or not. In this case, we can spoof user agent
string of our browser with our arbitrary commands that can bypass
stronger CodeIgniter Security class even if
$config['global_xss_filtering'] = TRUE;. Thus we can execute XSS on
the fly.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/