Full Disclosure mailing list archives
pisg XSS
From: <shr3kst3r () hushmail com>
Date: Wed, 21 Apr 2004 17:48:43 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ========================================================================= = pisg XSS ========================================================================= pisg is an IRC channel statics generator written in Perl, it creates statistics from different logfile formats. It was originally written because IRCStats wasn't open source. So here's an open source/GPL'ed version to anyone interested. It's a funny thing for your IRC channel, and it's highly customizeable. PROBLEM: pisg does not sanitize the nick of the user before posting to the web PROOF: 1. silc 2. /connect silc.net 3. /nick <script>alert(document.domain);</script> 4. /log ... 5. /me a couple of times on a channel 6. /quit 3. then generate stats ./pisg 4. surf the index.html MORE INFO: The silc-client, which is an old irssi-client with the silc stuff patched on, logs in the irssi format which pisg reads, and also silcd allows strange names like the above "<script>alert(document.domain);</script>". But, the major problem is, pisg does not sanitize the nick. This problem does not occur when using irssi connected to a regular ircd because the ircd does not allow the nick. The "/me <stuff>" is required, a regular /msg <channel> will not work. FIX: Sanitize everything. OTHER PROBLEMS: Could not find a security () pisg net or anything ressembling it. I can't spell. This might affect a whole 3 people in the world. de14a09207f3f7af64a492b4d1cc0e49 2c8db6262817d6a6225d11437e503c7e -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkCHFmkACgkQQdPEZ+t83SAm6gCgg7kn7JohnyOwLQCA0EvahOZs/B8A oLQkIdqWByGXgLN0FERvG9AlHo35 =rZ/n -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Free, ultra-private instant messaging with Hush Messenger https://www.hushmail.com/services.php?subloc=messenger&l=434 Promote security and make money with the Hushmail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- pisg XSS shr3kst3r (Apr 21)