Cross-site scripting vulnerability in redirect code - Githubissues

ventaur / securityswitch

Security Switch enables various ASP.NET applications to automatically switch requests for pages/resources between the HTTP and HTTPS protocols without the need to write absolute URLs in HTML markup.

Other

2 stars 0 forks source link

Cross-site scripting vulnerability in redirect code #30

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago

Hello, I have noticed a cross-site scripting issue specifically where using the 
Javascript redirect code to take users between HTTP and HTTPS.

For example if Login.aspx is set to be delivered over HTTPS only

If a malicious user crafts a link to http://example.com/Login.aspx?'+alert(1)+' 
the generated redirect Javascript is not escaped properly and the alert (or 
other code) will be executed.

This is the latest code running on IIS 7.5

Original issue reported on code.google.com by s...@latham-it.com on 5 Jan 2012 at 9:59

GoogleCodeExporter commented 9 years ago

Original comment by vent...@gmail.com on 21 Sep 2012 at 6:22

Changed state: Considering

GoogleCodeExporter commented 9 years ago

This has been a great module for many, many years. Don't know what I'd do 
without it! The XSS issue was just flagged by my PCI scanner. Yikes! Wanted to 
make sure you were aware this issue was having an impact in that area.

Original comment by se...@darlingtonschool.org on 12 Jun 2014 at 4:20

GoogleCodeExporter commented 9 years ago

After pondering how to get XSS protection in here without adding a dependency 
to another package/library, I decided to snag a bit of code from the Microsoft 
Web Protection Library: http://wpl.codeplex.com/

I've updated the redirect code that relies on JS and the license, as needed.

Please, feel free to run your site through the PCI scanner again and let us 
know the results. We can't have CC processors putting you out from using this 
module, so I'm hoping this remedies the problem.

Original comment by vent...@gmail.com on 15 Jun 2014 at 6:30

Changed state: Fixed

GoogleCodeExporter commented 9 years ago

Sorry for the late reply. I managed to make a patch myself to get PCI off my 
back but yours is certainly better. Now in place and it works like a charm. 
Many thanks!

Original comment by se...@darlingtonschool.org on 14 Oct 2014 at 6:51

GoogleCodeExporter commented 9 years ago

I'm glad to hear it! Thanks for the update.

Original comment by vent...@gmail.com on 15 Oct 2014 at 1:22

Changed state: Verified