SanitizeCSS is bypassable

[soaj1664]

Hi,

The function

confusa/lib/misc/input.php

Line 78 in 9e32af0

static function sanitizeCSS($input)

you are using for SanitizeCSS is bypassable and is vulnerable to an XSS.

e.g., the following attack vector will bypass it ..

width:expression(alert(1))

The regular expression only looks for word URL and small parenthesis ...

Thanks!

[henrikau]

Thanks for the report, I'll attend to it :)

Henrik

[soaj1664]

@henrikau May I suggest a better and unbreakable solution for CSS or style context if you would like :)

[henrikau]

On Tue, Jul 08, 2014 at 03:29:07AM -0700, Ashar Javed wrote:

@henrikau May I suggest a better and unbreakable solution for CSS or
style context if you would like :)

Hi,

You are more than welcome to provide a patch and if it looks sane I'm than
happy to apply it.

Also; github is moreof a backup-site, assembla [1] is the main repository
where the wiki is. We also have a mailing-list
([email protected]) [2] and an irc-channel #confusa@freenode. Feel
free to join any or all. :)

1. https://www.assembla.com/wiki/show/confusa
2. https://postlister.uninett.no/sympa_confusa/info/confusa-dev

Henrik Austad

[soaj1664]

@henrikau Here you go:

https://gist.github.com/soaj1664/2aab2c9ae51cf433aed3

It is very simple but bullet proof :) No one can execute JavaScript in style context if that function is in use. Some weeks ago I had announced a 1000USD XSS challenge and had recorded 78K+ XSS attack attempts and no bypass in any context ... see http://demo.chm-software.com/7fc785c6bd26b49d7a7698a7518a73ed/

Let me know when you will integrate this function ... or as per your requirement you can easily modify it ...

[soaj1664]

@henrikau I am waiting for your reply. What is your take on it after looking at the code ...

[henrikau]

I'm currently on holiday without access to my systems. Please send a patch
to [email protected] and if no one replies, I'll look at it next
week.

Henrik
On 10 Jul 2014 17:14, "Ashar Javed" [email protected] wrote:

@henrikau https://github.com/henrikau I am waiting for your reply. What
is your take on it after looking at the code ...

—
Reply to this email directly or view it on GitHub
#2 (comment).

[soaj1664]

@henrikau I will wait until next week so that you will be back :) Enjoy your vacations ...

[soaj1664]

@henrikau Hi again. I hope you are back from vacations :) Looking forward for the patch...

[soaj1664]

@henrikau Any update? Are you planning to integrate the code or leave the idea? Thanks!

[thijskh]

Fixed in Confusa 0.8.6.

[soaj1664]

@thijskh Great ...