Ratheesh Kumar

To day,  I spent my whole day to fix some of the security issues in newly built web application. It was interesting rather worth learning.

Issue No:  1  XSS (Cross Site Scripting)

The first vulnerability in my system was is Cross-site Scripting (XSS), which was found on  different input parameters  of the web site.    XSS occurs when a webpage displays user input that is not properly validated,  allowing a malicious user to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the page.  When successful, XSS vulnerabilities can be used to manipulate or steal cookies, create requests that can be mistaken for another user, compromise confidential information, or execute malicious code on end user systems.

You can read more about XSS from http://en.wikipedia.org/wiki/Cross-site_scripting

We used an automated scan tool to find these issues.  This tool will try to send java script code along with all parameters and see if it is executing in client browser, So all you can do it find the script and remove it or restrict user from proceeding with that parameter.

How to fix it,

Remove script from parameters, thats all we need to do, You can search for  ’<’ or script or etc to find out the script and remove it, But some one can send script like c%2fsCrIpT%3e%3csCrIpT%3ealert(55162)%3c%2fsCrIpT% , so we need to find all the possibilities of scripting,

I searched for following occurrences  in all parameters

 “<”, “%3C”,”&LT”, “&#60″, “&#060″, “&#0060″, “&#00060″,

 “&#000060″, “&#0000060″, “<”, “<”, “<”, “<”,

 “<”, “<”, “&#x3C”, “&#x03c”, “&#x003c”,

 “&#x0003c”, “&#x00003c”, “&#x000003c”, “<”, “<”,

 “<”, “<”, “<”, “<”, “&#X3c”,

 “&#X03c”, “&#X003c”, “&#X0003c”, “&#X00003c”, “&#X000003c”,

 “<”, “<”, “<”, “<”, “<”,

 “<”, “&#x3C”, “&#x03C”, “&#x003C”, “&#x0003C”,

 “&#x00003C”, “&#x000003C”, “<”, “<”, “<”,

 “<”, “<”, “<”, “&#X3C”, “&#X03C”,

 “&#X003C”, “&#X0003C”, “&#X00003C”, “&#X000003C”, “<”,

 “<”, “<”, “<”, “<”, “<”,

 “\x3c”, “\x3C”, “\u003c”, “\u003C”,

 “>”,”%3E”, “SCRIPT”,”..”

Can you think of any other way of inserting script in the parameter….?

You can replace these occurrences by empty string or forward to an error page..

Comments??

Issue 2 :  Directory Traversal Vulnerability

The goal of this attack is to access system files that are not intended to be accessible, such as password files or system logs.

You can learn more about this issue from http://en.wikipedia.org/wiki/Directory_traversal

Some time you might need to make a screen to download some file from file system and we might tend to put the full file path in a parameter to down load it, Never do it

Keep all the downloadable file a particular l folder or its sub folder,  then provide sub folder path in input parameters
For Example you want write a JSP  page to download any file from c:\yourapp\download\*.   Hard code c:\yourapp\download  in your server side program and pass the file name as a parameter , Also never allow “..”  in the parameter because an attacker can traverse back using “..”.

Comments