2

One of the sites I'm working on was subject to a penetration test and this is one of the items of feedback:

issue

I understand the issue in theory however as I've never had to deal with this sort of thing I haven't the slightest idea where to start and am looking for guidance - settings to change, config files to edit etc. I've added sanitization to other forms on the site, however as the search fields are generated by EE I'm unsure how to sanitize these inputs.

Site can be accessed here

1
  • Which version of ExpressionEngine are you using (2.8?) and are you using native search or an add-on? – foamcow Sep 17 '14 at 10:13
1

I just tested this (really quickly) on one of my sites running 2.8.1 and couldn't exploit the exp_csrf cookie in the way described by your report.

However I could do it on your site using the exact same method. So perhaps a simple update to 2.8.1 or higher will fix the problem for you.

UPDATE (from my comment) The site I tested on had no search form, although the cookie was present. I just tested on a site running 2.9 with a search form and managed to make the injection. I should add that this is without any input, simply the token being written into the form. I'm not exactly sure how this could be used by an attacker though since it involves manipulating the cookie on your domain - if that happens then you'd probably have bigger problems.

4
  • I'm using 2.8.1 as well, and the native search. – FuriousD Sep 17 '14 at 23:27
  • The site I tested on had no search form, although the cookie was present. I just tested on a site running 2.9 with a search form and managed to make the injection. I should add that this is without any input, simply the token being written into the form. I'm not exactly sure how this could be used by an attacker though since it involves manipulating the cookie on your domain - if that happens then you'd probably have bigger problems. – foamcow Sep 18 '14 at 7:49
  • They're not happy. Would it be possible to somehow sanitize this cookie value with a bit of behind the scenes work? Or is this really only something Ellis Labs could fix? – FuriousD Sep 26 '14 at 0:18
  • You could make your own changes to core files but be aware they would be overwritten if you updated. – foamcow Sep 26 '14 at 7:43
0

If this is using ExpressionEngine 2.9 then you can file a bug report using HackerOne:

https://hackerone.com/expressionengine

If not, upgrade to the latest version as there were some security fixes included in the 2.9.0 release:

https://ellislab.com/expressionengine/user-guide/about/changelog.html#version-2-9-0

Also, in practice it is difficult to actually exploit an XSS vulnerability through cookies, as the attacker would need to manipulate the user's cookies (which would require another vulnerability). See this question on SSE for more info about it here.

1
  • I can confirm this is present in 2.9 but as you say it's pretty difficult if not impossible to exploit without other vulnerabilites. – foamcow Sep 19 '14 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.