Re: XSS vulnerability in OpenBSD's CVSweb
"Edd Barrett" <[email protected]>
| Newsgroups | gmane.os.openbsd.www |
|---|---|
| Message-ID | <[email protected]> |
Afternoon, On Fri, Aug 22, 2008 at 7:47 AM, Reed Loden <[email protected]> wrote: > Greetings, > > There's an XSS vulnerability in www.openbsd.org's CVSweb instance: > http://www.openbsd.org/cgi-bin/cvsweb/src/?sortby=%22%3E%3Cscript%20src=%22http://wakaba.c3.cx/bee.js%22%3E%3C/script%3E > > I'd appreciate it if this could get fixed ASAP, as it hurts OpenBSD's > stance/reputation on security by having an open XSS vuln on its main > website. > > I'm trusting that you all know that XSS is bad, blah blah, etc. If you > all need any more information on why XSS is a very bad thing, just let > me know. You can probably fix this by stripping <, >, " and ' (possibly others) from the GET variables. I don't know much about perl otherwise I would jump in. -- Best Regards Edd http://students.dec.bournemouth.ac.uk/ebarrett