Details
Affected Software:WebChat Module for Jive
Fixed in Version:August of 2008
Issue Type:Cross Site Scripting
Original Code: Found Here
Description
This week’s vulnerability affected a webchat module created by Jive Software. The bug is straightforward, the JSP code takes an attacker controlled value and uses it to build dynamic HTML. Although the bug is straightforward,this week’s example was a great/simple exercise in identifying a vulnerable pattern and tracing to find other vulnerable patterns in the code. This week’s sample has three separate vulnerabilities that were all addressed via single patch. All these have similar symptoms/patterns (although the specifics are a bit different). Identifying vulnerable patterns and searching for these patterns in other places in code is an essential skill for security code auditors. Did you find all three bugs that were patched?
Developers Solution
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 | public class FormUtils { private FormUtils() { } public static String createAnswers(FormField formField,HttpServletRequest request) { final StringBuffer builder = new StringBuffer(); if (formField.getType().equals(FormField.TYPE_TEXT_SINGLE)) { String cookieValue = getCookieValueForField(formField.getVariable(),request); String insertValue = ""; if(ModelUtil.hasLength(cookieValue)){ insertValue = "value=\""+cookieValue+"\""; } - builder.append("<input type=\"text\"name=\""+ formField.getVariable() + "\""+insertValue+"style=\"width:75%\">"); +builder.append("<input type=\"text\"name=\""+ formField.getVariable() + "\""+StringUtils.escapeHTMLTags(insertValue)+"style=\"width:75%\">"); } else if (formField.getType().equals(FormField.TYPE_TEXT_MULTI)) { builder.append("<textarea name=\""+ formField.getVariable() + "\"cols=\"30\"rows=\"3\">"); builder.append("</textarea>"); } else if (formField.getType().equals(FormField.TYPE_LIST_SINGLE)) { builder.append("<select name=\""+ formField.getVariable() + "\">"); Iterator iter = formField.getOptions(); String cookieValue = ModelUtil.emptyStringIfNull(getCookieValueForField(formField.getVariable(),request)); while (iter.hasNext()) { FormField.Option option = (FormField.Option)iter.next(); String selected = option.getValue().equals(cookieValue) ? "selected":""; - builder.append("<option value=\""+ option.getValue() + "\""+selected+">"+ option.getLabel() + "</option>"); +builder.append("<option value=\""+ StringUtils.escapeHTMLTags(option.getValue()) + "\""+selected+">"+ option.getLabel() + "</option>"); } builder.append("</select>"); } else if (formField.getType().equals(FormField.TYPE_BOOLEAN)) { Iterator iter = formField.getOptions(); int counter = 0; while (iter.hasNext()) { FormField.Option option = (FormField.Option)iter.next(); String value = option.getLabel(); builder.append("<input type=\"checkbox\"value=\""+ value + "\"name=\""+ formField.getVariable() + counter + "\">"); builder.append(" "); -builder.append(value); +builder.append(StringUtils.escapeHTMLTags(value)); builder.append("<br/>"); counter++; } } |