Last modified: 2006-11-14 20:29:37 UTC
Problem ------- It is possible to conduct a cross-site-scripting attack against the search page when it displays Google and Yahoo search forms. There is a lack of validation before returning the original query to the user. Affected -------- It seems that only French, Dutch and Russian pages are displaying Google and Yahoo search forms. Attack vector ------------- "><script>alert('XSS')</script> PoC --- http://fr.wikipedia.org/wiki/Special:Search?search=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go http://nl.wikipedia.org/wiki/Special:Search?search=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go http://ru.wikipedia.org/wiki/Special:Search?search=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go Solution -------- Filter :)
Confirmed, though haven't identified if it's the Lucene extension, the built-in search or something special about the fallback behaviour at the moment. Looking now.
Aha. http://fr.wikipedia.org/wiki/MediaWiki:Monobook.js seems to have a useful little hack (do a find in your browser for "yahooSearch") which contains the vulnerability.
I've corrected the bad JS code on these sites. Sigh.
Another vote against custom JavaScript. Sadly, administrators are not necessarily l33t script writers as well...
This specific XSS was corrected. What about other vectors? Attack vector ------------- "<>"<script>alert('XSS')</script> PoC --- http://fr.wikipedia.org/wiki/Special:Search?search=%22%3C%3E%22%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go http://nl.wikipedia.org/wiki/Special:Search?search=%22%3C%3E%22%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go http://ru.wikipedia.org/wiki/Special:Search?search=%22%3C%3E%22%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&go=Go Bug reopened.
Man, I have JavaScript's class library (such as it is). String's replace() method only replaces the first occurance by default. *boggle* Fixed.
>Another vote against custom JavaScript. Sadly, administrators are not >necessarily l33t script writers as well... Well, how long have we been waiting for a better search page ? Administrators are just patching :) Though for that XSS stuff I plead 100% guilty, I completely forgot the XSS issue. Another piece of code I made, the array generator ("popupTableau") is more secure (I hope) as inputs go through JS parsing functions.
btw. Brion is right, JS sucks.
