XSS Vulnerability

Hey,

McAfee Secure picked up this vulnerability on my site. It's nothing terrible from the looks of it, but should still be patched in my opinion. I'm trying to think it through, but am no means an expert.

It occurs when adding this to the query string (easily done on the search results page)

&>"><style>body{text-decoration%3Ablink}<%2Fstyle>=110

In this case, it's making my entire site blink. I've traced it back to the zen_get_all_get_params and think that it needs to just to sanitize the key and value before output. Thoughts?

Hi

Which version of Zen Cart are you using.

I was on 1.3.9b when this was found.
I've recently updated to 1.3.9c

Hi,

Currently, I can not reproduce this on any version since 1.3.8.

In all cases the " in the url is encoded to " this removes the possibility of a simple XSS injection as the href tag cannot then closed prematurely.

Are you using any contributions that might have altered the code in html_output.php, most probably an SEO contribution?

Hi there,

I do have SSU installed, but it's set to exclude the search page.

You're right that the quotes are re-written to " - when checking my source I can confirm that.

I also did more checking and found that my page only blinks in FireFox, and not IE, Safari or Chrome.

Here's what is looks like when the code is injected. This is the link to page 2 search results.

"http://www.avshop.ca/index.php?main_page=advanced_search_result&search_in_description=1&keyword=test&>\&quot;><style>body{text-decoration:blink}</style>=110&inc_subcat=0&sort=1a&page=2" title=" Page 2 ">

k,

Thanks for the link. If I look at the html source, I see this

<div class="buttonRow back"><a href="http://www.avshop.ca/advanced_search/>\\\"><style>body{text-decoration:blink}</style>/110?search_in_description=1

This is where the injection is taking place.

However this link is not being built using the standard Zen Cart code as the link should be index.php?main_page=advanced_search.

I therefore have to assume that it is something that is being created by some SEO contribution.

Thanks so much for checking!

I think the easiest fix right now is to remove the back button code until I have more time to dig into it.

Are there any implications to filtering out brackets from the query string? ie changing < > to > <

Hi,

In a properly configured Zen Cart the type of injection you describe isn't a true injection (due to the escaping of the quotes).

However it is likely to cause false positives on PCI scans.

We've addressed this by running extra sanitization of url parameter keys.

We've tested a fix with some folks who were reporting these scan failures and will roll this into the next update release for v1.3.9