New Zenner
- Join Date:
- Jul 2010
- Posts:
- 30
- Plugin Contributions:
- 0
Results of PCI Security Scan show potential for XSS
Hi,
Sorry if this is totally the wrong place, but I can't see anywhere more appropriate. My site has just had a quarterly scan by Security Metrics and the scan has thrown up a potential problem.
Install is ZC v1.50; it was a new install. I've installed lots of add-ons, however ones I've added since the last (successful) scan last October are;
- Product Images on Invoice Email
- Keepalive Timer beta
- Search Suggestions with Images
- User Tracking v1.4.0
- Backup mysql plugin v5
- Backup zc v1
- Snow javascript (currently not enabled)
- Updated Ceon URI Mapping from v1.2/4.2 to v1.4/4.4
- Auto Facebook v2
The site has recently been moved to a fully PCI-DSS compliant server at TerraNetwork, with up-to-date versions of everything.
Here is an excerpt from the scan report;
"Description: CGI Generic Cross-Site Scripting (Parameters Names) Synopsis:
The remote web server is prone to cross-site scripting attacks. Impact: The
remote web server hosts CGI scripts that fail to adequately sanitize
parameters name of malicious JavaScript. By leveraging this issue, an
attacker may be able to cause arbitrary HTML and script code to be
executed in a user's browser within the security context of the affected site.
See also : http://en.wikipedia.org/wiki/Cross_site_scripting
http://capec.mitre.org/data/definitions/86.html
http://projects.webappsec.org/Cross-Site+Scripting Data Received: Using the
GET HTTP method, SecurityMetrics found that : + The following resources
may be vulnerable to XSS (on parameters names) : /Stuff-For- The-BIGOnes/
Music-CDs/Rough-Guide-to-Caribbean-Cafe-2xCD?<<<
<<<<<<<foo"bar'314>>>>>=1 -------- request -------- GET /Stuff-For-The-
BIG-Ones/Music-CDs/Rough- Guide-to-Caribbean-Cafe-2xCD?
<<<<<<<<<<foo "bar'314>>>>>=1 HTTP/1.1\r Host:
www . s i m p l y t h e b e s t o n t h e w e b .co.uk\r Accept-Charset: iso-8859-1,utf-
8;q=0.9,*;q=0.1\r Accept-Language: en\r Connection: Close\r Cookie:
zenid=fk9u1rd9cesr4rrj3q0bd4nk94\r User-Agent: Mozilla/4.0 (compatible;
MSIE 8.0; Windows NT 5.1; Trident/4.0)\r Pragma: no-cache\r Accept:
image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png, / -----------
------------- -------- output -------- <meta property="fb:admins"
content="252442044833309"/> <meta property="og:type"
content="Fairtrade, Fair Trade, Fairly Tr [...] <meta property="og:url"
content="http://www . s i m p l y t h e b e s t o n t h e w e b .co.uk/ Stuff-For-The-BIGOnes/
Music-CDs/Rough-Guide-to-Caribbean-Cafe-2xCD?<<<<
<<<<<<foo"bar'314>>>>>=1" /> <meta property="og:image"
content="https://www . S i m p l y T h e B e s t O n T h e W [...] <meta
property="og:description" content="Buy Fair Trade Online Rou [...] -------------
-----------"
The URL for the item in question (the scan lists lots) is;
"https://www . s i m p l y t h e b e s t o n t h e w e b .co.uk/Stuff-For-The-BIGOnes/Music-CDs/Rough-Guide-to-Caribbean-Cafe-2xCD", as generated by Ceon URI Mapping module.
Now - the big question is... is this actually a Zen Cart security problem? If so, then I've come to the right place. If not....can you point me in the right direction for plugging this hole? I've already added a bit of code in init_sanitize.php using preg_replace, following a previous scan fail (this worked, so the re-scan passed). I'm at a loss on where to put code for this, though. It looks like I need to get rid of all 'nasties' after the correct URL - but where?
I'm not asking for it to be fixed for me - just a helping hand as to where I should be looking to learn how to fix it myself and where to put the code. If it means getting hold of a developer to take a look at it for me, then so be it - but I'd much rather keep my site development in-house.
TIA,
Gavin
