[bWM#012] Passing script/html-filter with special chars (multibrowser)

[<ben.moeckel@badwebmasters.net>]

ben moeckel security research - http://badWebMasters.net - security
advisories
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - 


badWebMasters security advisory #012:

	Passing script/html-filter with special chars (multibrowser)


Discovery date: 2003-07-16

Author: 

	ben moeckel (http://distressed.de)
	mailto: badwebmasters@online.de


Description:

	When webbrowsers parse html they remove special chars,
	this behavior may be used by an malicious user to fool 
	script/html-filters in webapplications.


Detail:

	badWebMasters showed in their advisory #011 how to pass
	the "Snitz Forums"-scriptfilter with the Tab-Char (09).
	After "Opera" and "Mozilla"-users noticed that the
	provided exploit didn't work on their system I decided
	to start some new testings, with an amazing result!

	To detect what kind of special chars can be used in html-
	parameters I set up the following asp-page:

	-------------------------------------------2.asp---------
	<%@LANGUAGE=JScript%><%

	%><script>function a(o){alert(o)}</script><%
	%><img src="javascript:a('test')" /><%

	for(i=0;i<256;++i){
		uc = "%"+chk(i.toString(16));
		%><img src="ja<%=unescape(uc)%>vascript:a(<%=i%>)" />
	<% }

	function chk(sInp){if(sInp.length<2){
		return String("0"+sInp)
	}else{return sInp}}
	%>
	---------------------------------------------------------

	The page has been viewed with Mozilla, Opera and Internet-
	Explorer, the alert-box poped up in this order:

		Mozilla 1.3.1 (Win32): 	0 (with restricions)

		Opera 7.11 (Win32): 	0, 9, 10, 13, 173

		Internet Explorer 5.0:	13, 10, 9, 0

	Mozilla doesn't allow the window.alert()-method in "javascript:"-
	images, so I had to use my own function "a()". It also returned 
	an error for char 9, 10 and 13: "Error: unterminated regular 
	expression literal".

	Webmasters may be carefull with char 173 (ADh) that can be used
	in Opera only.

	And last but not least silly Internet Explorer: reversed order!?


Test:

	http://badwebmasters.net/advisory/012/test.asp


Workaround:

	This advisory adresses all webapps that use a badword filter,
	make sure all control-chars are removed before badwords are 
	removed!


References: 

	badWebMasters advisory #011: Cross-Site-Scripting @ Snitz Forums
	- http://cert.uni-stuttgart.de/archive/bugtraq/2003/04/msg00247.html


Feedback: 

	Comments, suggestions, updates, anything else?
		-> mailto:badwebmasters@online.de


Source:

	http://badwebmasters.net/advisory/012/ (text/html)


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - 
Copyright 2003 by ben moeckel (Benjamin Klimmek) for badWebMasters.
http://badwebmasters.net