full-disclosure - [FD] Insecure python cgi documentation and tutorials are vulnerable to XSS.

Open Source and information security mailing list archives

Message-ID: <CAGUWgD-VnyNYUyt3+2QvgSa8V0eAde+637CkA4nBg45t9k1oyw@mail.gmail.com>
Date: Tue, 21 Mar 2023 17:28:44 +0200
From: Georgi Guninski <gguninski@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] Insecure python cgi documentation and tutorials are vulnerable
	to XSS.

Is there low hanging fruit for the following observation?

The documentation of the python cgi module is vulnerable to XSS
(cross site scripting)

https://docs.python.org/3/library/cgi.html

```
form = cgi.FieldStorage()
print("<p>name:", form["name"].value)
print("<p>addr:", form["addr"].value)
```

First result on google for "tutorial python cgi"
is https://www.tutorialspoint.com/python/python_cgi_programming.htm

And it is almost the same as the python doc.

I verified that setting ```name=<script>alert(document.domain)</script>```
will trigger dialog, demonstrating javascript is executed
on the cgi host.

I would expect that devs who read the docs or tutorials will write
vulnerable cgis.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives