full-disclosure - Re: Question regarding script vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <28F3FAFA-ACD2-4B5F-8051-0C12E91A3BF8@whiuk.com>
Date: Thu, 20 Dec 2012 13:00:08 +0000
From: Philip Whitehouse <philip@...uk.com>
To: Rand McRanderson <therandshow@...il.com>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Question regarding script vulnerabilities

Malicious scripts are generally designed to one of two targets:

1) The user-base of the target.

An XSS vulnerability typically gives you the ability to hijack a users browser, possibly allowing remote code execution on their machine or intercepting keystrokes while on the site. In addition to allowing your users (and admins) data to be harvested you suffer reputational damage.

2) Remote code targeting the actual site. 

If the file has permissions, it could delete files on the server.

So now we have established the purpose, let's consider deployment:

1) File upload.

Many websites deliberately allow file upload (avatars on forums, images for blog posts, shared files and so forth). If not correctly sanitised there is little stopping them uploading a server side script, client side script or other nefarious file.

Incidentally this was the main threat of the image exploit - websites couldn't guarantee uploaded avatars didn't contain executable code.

2) Script tags

Typically forums will sanitise text to remove script tags. Blogs are often less punitive. If anyone can upload HTML raw then via privilege escalation or hijack there is the potential for an attacker.

To be honest if you even slightly suspected your host, you're screwed - malicious scripts are the least of your problems...

Philip Whitehouse

On 19 Dec 2012, at 05:25, Rand McRanderson <therandshow@...il.com> wrote:

> I was curious, if you have a virtual dedicated server or a dedicated server, and a reasonably trustworthy hosting service, are malicious scripts planted by external people a big concern? If so why?
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/