What's New?

[CLOSED] FormPanel Url XSS

Page 1 of 2 12 LastLast
  1. #1
    Jun 18, 2013, 7:02 AM

    [CLOSED] FormPanel Url XSS

    Hi,

    If you call page below with this querystring "?_dc=javascript:alert(1);", xss is not being filtered and it can be seen in output (url:"/test.aspx?_dc=javascript:alert(1);").

    Is there a way to filter it? 

    <%@ Page Language="C#" %>

<%@ Register Assembly="Ext.Net" Namespace="Ext.Net" TagPrefix="ext" %>

<!DOCTYPE html>
<html>
<head id="Head1" runat="server">
    <title>Ext.NET XSS</title>
</head>
<body>
    <form id="Form1" runat="server">
        <ext:ResourceManager ID="ResourceManager1" runat="server">
        </ext:ResourceManager>
        <ext:FormPanel runat="server">
            <Items>
            </Items>
        </ext:FormPanel>
    </form>
</body>
</html>
    Thanks,
    Vzx
    Last edited by Daniil; Jun 19, 2013 at 5:21 PM. Reason: [CLOSED]
  2. #2
    Jun 18, 2013, 12:41 PM
    Hi @vzx,

    Quote Originally Posted by vzx View Post
    it can be seen in output (url:"/test.aspx?_dc=javascript:alert(1);").
    In output? Do you mean the page sources? Could you demonstrate where exactly you see it?
  3. #3
    Jun 18, 2013, 1:01 PM
    Quote Originally Posted by Daniil View Post
    Hi @vzx,

    In output? Do you mean the page sources? Could you demonstrate where exactly you see it?
    Yes Daniil, in page sources. IE gives a warning also like below and modifies output.

    "Internet Explorer has modified this page to help prevent cross-site scripting."
  4. #4
    Jun 18, 2013, 2:59 PM
    So, are you seeing it here?
    <form method="post" action="Work2.aspx?_dc=javascript%3aalert(1)%3b" id="Form1">
    And would you like to eliminate a query string from that "action" URL?
    Last edited by Daniil; Jun 19, 2013 at 1:18 PM.
  5. #5
    Jun 19, 2013, 1:29 PM
    Could you also clarify what the exact steps to reproduce an XSS warning using your test case? What is IE version?
  6. #6
    Jun 19, 2013, 1:51 PM
    Quote Originally Posted by Daniil View Post
    Could you also clarify what the exact steps to reproduce an XSS warning using your test case? What is IE version?
    Just call the page with this querystring like "test.aspx?_dc=javascript:alert(1);"

    I am testing it with IE10. You can find warning's picture attached.

    PS: IE is changing formpanel's url in response as;

    url:"/LifeIn/test.aspx?_dc=javasc#ipt:alert(1);"
    Attached Thumbnails Click image for larger version.  Name: Untitled.png  Views: 15  Size: 1.9 KB  ID: 6413  
  7. #7
    Jun 19, 2013, 2:09 PM
    What a reason to use such query string? Is it for testing only?
    It is not XSS, XSS when an attacker has posibility to execite script in the browser of another user. In this case, there is no script execution because url is rendered as string constant. So, that warning is just IE10 mistake

    In any way, we will encode url for FormPanel
  8. #8
    Jun 19, 2013, 2:46 PM
    Fixed in SVN, now url is encoded
  9. #9
    Jun 19, 2013, 2:54 PM
    Quote Originally Posted by Vladimir View Post
    Fixed in SVN, now url is encoded
    It had come to me as a security issue.

    Thank you all.

    Vzx
  10. #10
    Jun 19, 2013, 5:23 PM
    Quote Originally Posted by vzx View Post
    It had come to me as a security issue.
    Could you, please, clarify what exactly is the threat of this issue? Just curious.
Page 1 of 2 12 LastLast

Similar Threads

  1. FormPanel don't get FileUploadField value
    By caio.vidal in forum 2.x Help
    Replies: 2
    Last Post: Jun 18, 2013, 1:21 AM
  2. FormPanel
    By nedimkeskin in forum 2.x Help
    Replies: 3
    Last Post: Jan 31, 2013, 12:10 PM
  3. Div, FormPanel
    By rookie in forum 1.x Help
    Replies: 3
    Last Post: Nov 22, 2012, 1:10 PM
  4. [FormPanel] Buttons dinamically + Before script + User Control + Iterate over all FormPanel's of the window
    By marcoslimagon in forum 1.x Help
    Replies: 0
    Last Post: Nov 17, 2011, 10:53 AM
  5. How to get the FormPanel in which button is placed?
    By huzzy143 in forum 1.x Help
    Replies: 2
    Last Post: Sep 10, 2011, 6:04 PM

Tags for this Thread

Posting Permissions