ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It only takes a minute to sign up.
Sign up to join this community
One of the sites I'm working on was subject to a penetration test and this is one of the items of feedback:
I understand the issue in theory however as I've never had to deal with this sort of thing I haven't the slightest idea where to start and am looking for guidance - settings to change, config files to edit etc. I've added sanitization to other forms on the site, however as the search fields are generated by EE I'm unsure how to sanitize these inputs.
Site can be accessed here
I just tested this (really quickly) on one of my sites running 2.8.1 and couldn't exploit the exp_csrf cookie in the way described by your report.
However I could do it on your site using the exact same method. So perhaps a simple update to 2.8.1 or higher will fix the problem for you.
UPDATE (from my comment) The site I tested on had no search form, although the cookie was present. I just tested on a site running 2.9 with a search form and managed to make the injection. I should add that this is without any input, simply the token being written into the form. I'm not exactly sure how this could be used by an attacker though since it involves manipulating the cookie on your domain - if that happens then you'd probably have bigger problems.
If this is using ExpressionEngine 2.9 then you can file a bug report using HackerOne:
https://hackerone.com/expressionengine
If not, upgrade to the latest version as there were some security fixes included in the 2.9.0 release:
https://ellislab.com/expressionengine/user-guide/about/changelog.html#version-2-9-0
Also, in practice it is difficult to actually exploit an XSS vulnerability through cookies, as the attacker would need to manipulate the user's cookies (which would require another vulnerability). See this question on SSE for more info about it here.
