[FD] Cross-Site-Scripting (XSS) in tcllib's html::textarea

SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: Cross-Site-Scripting (XSS) in tcllib's html::textarea Release Date: 26 February 2015 Last Modified: 26 February 2015 Author: Ben Fuhrmannek [ben.fuhrmannek[at]sektioneins.de] Application: tcllib - Tcl standard library - versions 1.0.0 to 1.16; html package versions lower than 1.4.4 Severity: The use of html::textarea always results in XSS. Risk: High Vendor Status: resolved with html package version 1.4.4 Reference: http://ift.tt/1Bvw0A7 http://ift.tt/1DsMIwy Overview: "The Tcl Library is a kitchen sink of packages across a broad spectrum of things." - Tcl Library Home (http://ift.tt/1BvvZfq) Applications using tcllib's ::html::textarea functions are vulnerable to Cross-Site-Scripting. This function is usually used to programmatically add an HTML
<br />to the output stream of a CGI script.<br /><br /> No publicly available software has been found to be vulnerable. However it is<br /> suspected that many non-public Tcl web applications using the<br /> ::html::textarea function are in operation.<br /><br />Details:<br /><br /> User supplied input is directly inserted into the<br />
<br />as default<br /> value, e.g. a textarea named 'ta' with a parameter of ta=XXX results in<br /> `<br />
<br />XXX<br />
` This can be used to break out of the
<br />-context and insert arbitrary<br /> HTML content such as -Tags.<br /><br /> The attack is possible using HTTP GET requests as well as POST and multipart<br /> form encoded POST requests.<br /><br /> Code:<br /><br /> modules/html/html.tcl<br /> (http://ift.tt/1DsMIwA)<br /> lines 914-919<br /><br /> proc ::html::textarea {name {param {}} {current {}}} {<br /> ::set value [ncgi::value $name $current]<br /> return "<[string trimright \<br /> "textarea name=\"$name\"\<br /> [tagParam textarea $param]"]>$value<br />
\n" } Proof of Concept: test.cgi #!/usr/bin/env tclsh package require ncgi package require html ::ncgi::parse ::ncgi::header puts [::html::textarea ta] http://ift.tt/1DsMGER cript%3E Recommendation: It is recommended to upgrade tcllib's html package to the current trunk version. In the meantime, a quick application level bugfix would be to encode the input variable in question manually. Example with 'ta' as name: set ::ncgi::value(ta) [::html::quoteFormValue [::ncgi::value ta {}]] Disclosure Timeline: 28 January 2015 - submitted bug to Tcl Library bugtracker http://ift.tt/1DsMIwy 28 January 2015 - ticket was changed to priority '8', severity 'Severe' 24 February 2015 - ticket was changed to priority '9 Immediate', severity 'Critical' 26 February 2015 - ticket resolved and closed with revision 212d1feefe http://ift.tt/1BvvZfu 26 February 2015 - released advisory CVE Information: The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a name to this vulnerability yet. GPG-Key: pub 4096R/B379CF81 2014-08-01 [expires: 2016-09-06] Key fingerprint = FD91 EEC1 F7F1 48E3 DBBE AB10 9168 88DF B379 CF81 Copyright 2015 SektionEins GmbH. All rights reserved.



Source: Gmail -> IFTTT-> Blogger