p5pRT
commented
21 years ago From perl-5.8.0@ton.iguana.be
Created by perl-5.8.0@ton.iguana.be
CGI.pm uses the object hash to store the parameter name/value pairs. This means that you can use the parameters of a query to set most internal attributes.
In particular\, you can set things like "dontescape".
On at least one public website (identity withheld) running the CGI.pm coming with 5.8.0 ($CGI::VERSION='2.81') I could do:
http://site.xxx.yyy/?field=qwe%22%3EX%3Cblink%3EXX%3Cx+x%3D%22&dontescape=1
where the "addr" parameter normally ends up in a input field with proper escaping\, but by adding the dontescape=1\, I can close the field and actually activate the \
Same idea from the commandline: perl -wle 'use CGI; $q=CGI->new; print $q->textfield($q->param("foo"))' foo="qwe%22%3EX%3Cblink%3EXX%3Cx+x%3D%22"\&dontescape=1
which outputs:
\X\
Or:
perl -MCGI=:standard -wle 'print escapeHTML(param("arg"));' arg=%3Cxss+here%3E\&dontescape=1
outputting:
\
Some other internal attributes look usable too.
I think it's a fundamental mistake to use the object hash itself as the place to hold parameter name/value pairs.
The most recent CGI.pm (3.00) seems to have renamed dontescape to escape and initialize it by default which fixes it for that particular variable\, but any that don't get initialized (and there seem to be several like .cgi_error\, separator\, final_separator\, .header_printed\, .r\, .path_info\, cache\, .parametersToAdd\, .cookies\, .raw_cookies\, .tmpfiles) are still vulnerable to this. Some of them still seem interesting to control output and several are trivially useable to cause the CGI to error (DOS). Even if you initialize them all\, it's still very easy to forget this on any changes. It also makes some actual fieldnames unusable.
Here's a "crash the CGI" example: perl -MCGI=:standard -e 'cookie()' .cookies=1
Migrated from rt.perl.org#24294 (status was 'resolved')
Searchable as RT24294$