[VulnDiscuss] Re: TRACE used to increase the dangerous of XSS.

----- Original Message -----
From: "Jeremiah Grossman" <[email protected]>
To: "Sverre H. Huseby" <[email protected]>
Cc: <[email protected]>; <[email protected]>;
<[email protected]>
Sent: Thursday, January 23, 2003 8:03 AM
Subject: Re: TRACE used to increase the dangerous of XSS.



...

> > -------------
> > Disable TRACE requests either in the firewall or in the web server,
>
> I am not familiar with any HTTP aware network based firewalls which have
> the ability to see inside of an HTTP request looking for TRACE and then
> deny. Likely because its too much overhead per request. But hey, I could
> be wrong, maybe there is one.

There are, read up on firewalls, will you.

> If someone visits a page hosted anywhere on Domain A, using XST, the
> page owner may now access cookies and basic auth credentials from
> *.domainA.tld. But, restricted to that domain without further help. The
> argument may be made on why you would need to go beyond that domain
> anyway for access.

Poor examples. If there's a browser bug or exploit, or if someone's using
joe.domain.tld and joe writes his cookies as valid to domain.tld, then of
source bob.domain.tld can grab that user's cookies, for example. That is
nothing new.

>
> > For the programmer
> > ------------------
> > The article shows quite clearly that one should not try to solve a
> > class of security problems by _adding_ artificial "solutions" rather
> > than _removing_ the real problem.  The problem we are talking about is
> > Cross-site Scripting (XSS).  The artificial solution added on top of
> > it is httpOnly cookies.  Lazy (and ignorant) programmers may think
> > that if they use httpOnly, they need not pay attention to XSS.  Your
> > article shows that the lazy ones are wrong.  Creative people tend to
> > find ways around the add-ons.
>
>
> Many of us have spent countless hours dealing with and mitigating XSS,
> generally through input/output filtering. In the meantime, hoping
> someone would find some way to easily deal with the problem generically.

Proper coding to prevent this, as well as perhaps some rewrite rules to
control what you serve up (assuming it's not spoofed, in which case the call
would need to be made via the server, not the client's browser). I realize
the implications you are trying to explain go beyond this, but my point is
that they, your alert and press release are trivial at best and as someone
else stated, laughable.

> For the programmer, XSS is just too easy to forget about or not know
> about. The best hope we had at the time was httpOnly or some variant.

So, you're going to scream about these trivial and hyped up claims and say
that you've found a serious vulnerability in ALL web servers? Hey, why don't
you offer to test out your theory on a real server and let one of us
illustrate to you that this isn't the big issue you claim it is.

Truly, you go from a few years ago asking me how to play around with some
chat rooms, to me showing you how, to you doing it, only later to claiming
you and your friend are experts? "He is considered to be among the foremost
web security experts at the leading edge of tomorrow's security technology."
in only a couple of years from you evolving to trying and failing to do
JavaScript alert pop-ups in chat rooms? When did you become an 'expert'?
Again, I'm not trying to make this personal and when I first replied to
another post in the mailing list, I didn't even see the name or know you
were involved.

Mind you, you can learn and educate yourself on this like everyone else, but
I see the problem right there. You haven't (much). Not that this is
relevant, other than I can see why you think this is a big deal and hyped
it -- you don't know any better (still). People in this field longer than
you (not that this means anything to discredit you) are explaining the facts
about how this is not what you make it out to be. I think it's prudent to
point out that you're obviously (still) a little green at this. Not to
insult you, but to encourage you to educate yourself on this more before you
go around making press releases trying to tell people you've found a major
vulnerability in every web server software out there, which will work with
any browser to commit 'frightening' exploits. This is simply not true.

I apologize if I am perhaps a little brutal about my honesty. But I
recognize you after I see this silly press release and claim and it just
bothers me. It's making the ignorant paranoid and the people that know
annoyed. With all due respect, no one enjoys wasting their time and
obviously some web sites will print anything they are convinced is a real
threat. Don't even get me started on this 'WhiteHat Arsenal' deal either.
I'm just saying, I don't know where you came from all of the sudden, and to
come here trying to hype up some thing that is not deserving of it, I guess
it just bothers me.

Again, I didn't intend for this to get personal (and I realize it probably
sounds that way) because that's irrelevant, but that I think it's relevant
to explain my experience with you and to point out that you're still green
to this, no matter what your hyped up press releases claim about you being a
'foremost expert' in this field. What is this world coming to... Oh well.
Please just don't waste everyone's time, I don't appreciate snake oil, nor
do others. I understand you got excited about this, but you need to take a
little more time to discern if it's what you think it is, especially if
you're going to scream to the world about how vital and urgent it is --
because it's not. Good job trying, though. I'll end on that thought.
Goodbye.

Regards,
Tim Greer  [email protected]
Server administration, security, programming, consulting.