Wednesday, 30 April 2014

CERT-UK Search XSS

Whenever I see an input field I automatically think XSS. So looking at the new CERT-UK website (https://www.cert.gov.uk) I saw they had a search box and straight away thought "XSS?".

Entering a test payload in the search box:



It turns out the search output wasn't properly encoded:



Whenever you find an XSS the next step is obviously to make a pretty "XSS on " + document.domain screenshot right? However I found out they had some character filtering/escaping for quotes and plus signs. But that of course could be bypassed with a little javascript trickery. For example:

https://www.cert.gov.uk/?s="><iframe/onload=a=document.domain;b=String.fromCharCode(88,83,83,32,111,110,32);alert(b.concat(a));>

To get the classic:



I immediately reported the issue to CERT-UK and had a response+fix within a few hours.



I discovered this issue the day the site was released, 31st March. At the request of CERT-UK I delayed the release of this post to allow time to fix any other issues.


Final Thoughts

Another day, another XSS. Being from the UK it did feel a little embarrassing that such an obvious issue got missed but then again it just goes to show whether you are cyber ninja's from CERT-UK or mom+pop pie store from Nebraska, mistakes happen.

Today's lesson is don't trust third party developers when they say everything is secure. Test it yourself (preferably on a regular basis) and verify their claims.

Thanks again to CERT-UK for their fast response, you can follow them here @CERT_UK

Pwndizzle out.

26 comments:

  1. Do you want to learn more about narrative essay writing? Here you can get some tips

    ReplyDelete
  2. Given article is very helpful and very useful for my admin, and pardon me permission to share articles here hopefully helped :

    Obat Gabagen Tradisional
    Obat Pendarahan Lambung Alami
    Cara Menghilangkan Darah Manis Secara Alami
    Cara Mengobati Abses Payudara Tanpa Operasi

    ReplyDelete
  3. Thank you i like your blog
    [url=https://golsarmusic.ir/%d8%b3%db%8c%d9%86%d8%a7-%d9%be%d8%a7%d8%b1%d8%b3%db%8c%d8%a7%d9%86-%d8%b4%da%a9%d8%a7%d9%81/]سینا پارسیان شکاف[/url]
    [url=https://golsarmusic.ir/%da%a9%d8%a7%d9%85%db%8c-%db%8c%d9%88%d8%b3%d9%81%db%8c-%d8%b3%d9%86%db%8c%d9%88%d8%b1%db%8c%d8%aa%d8%a7/]کامی یوسفی سنیوریتا[/url]

    ReplyDelete
  4. I found this is an informative blog and also very useful and knowledgeable. I would like to thank you for the efforts you have made in writing this blog norton.com/setup
    www.norton.com/setup

    ReplyDelete
  5. Nice post, you give the clear idea of the topic and I subscribed your blog, I have some links to share here norton.com/setup
    www.norton.com/setup


    ReplyDelete
  6. I'm so glad and enjoyed your BLOG, It is very informative on the subject or topic, and Thanks For Sharing this post. I have something to share here www.avg.com/retail

    www.avg.com/activate

    avg.com/activate

    avg.com/retail

    ReplyDelete
  7. Thanks for sharing with us your wonderful knowledge website keep it up xanax for sale

    ReplyDelete
  8. I'm so glad and enjoyed your BLOG, It is very informative on the subject or topic, and Thanks For Sharing this post.Xanax sale

    ReplyDelete
  9. Hello. Please check the task I have just sent and reply as soon as possible. I want an adjustment assignment done within a period of one week. I have worked with an Accounting Homework Help tutor from your team and therefore I know it’s possible to complete it within that period. Let me know the cost so that I can settle it now as your Accounting Assignment Help experts work on it.

    ReplyDelete
  10. That is a huge number of students. Are they from the same country or different countries? I also want your math assignment help. I want to perform in my assignments and since this is what you have been doing for years, I believe you are the right person for me. Let me know how much you charge for your math homework help services.

    ReplyDelete
  11. I don’t have time to look for another expert and therefore I am going to hire you with the hope that I will get qualityeconomics assignment help. .Being aneconomics homework help professor I expect that your solutions are first class. All I want to tell you is that if the solutions are not up to the mark I am going to cancel the project.

    ReplyDelete
  12. Hey there, I need an Statistics Homework Help expert to help me understand the topic of piecewise regression. In our lectures, the concept seemed very hard, and I could not understand it completely. I need someone who can explain to me in a simpler way that I can understand the topic. he/she should explain to me which is the best model, the best data before the model and how to fit the model using SPSS. If you can deliver quality work then you would be my official Statistics Assignment Help partner.

    ReplyDelete
  13. Just what I was looking for. I am struggling with my accounting assignment. I want an Accounting Assignment Help tutor to offer me two services. One is to complete my accounting assignments and the other is to provide me with online classes. I believe you are experienced enough to offer both Accounting Homework Help and online classes. I know you charge assignments based on the bulk. Tell me how much you charge for the online classes per hour.

    ReplyDelete
  14. As much as there are discouragements, it is true that mathematics is hard. Like in my case, I was never discouraged by anyone about math but I still find it very hard and that is why I am requesting your Math assignment help. I am tired of struggling with mathematics and spending sleepless nights trying to solve sums that I still don’t get right. Having gone through your Math homework help, I am sure that I will get the right help through you. Please tell me what I need to be able to hire you.

    ReplyDelete
  15. I have submitted my assignment to your website without any challenges. The economics assignmenthelp expert handling my assignment has already contacted me and I am certain that my work is underway. I am just hoping that I will get quality economics homework help. I have a lot of hopes in you and I am just hoping that you will not disappoint me.

    ReplyDelete
  16. How much do you charge for a Statistics Assignment Help task? Take, for my case, where I need you to provide me with the Statistics Homework Help on plotting a scatter plot with a regression line? How much should that cost? Do you charge on the basis of the workload or have a constant payment?

    ReplyDelete
  17. This is just what I'm looking for: a great site with interesting material. Thank you for creating this website; I will return. I seldom come across blogs.

    ReplyDelete
  18. I found this is an informative blog and also very useful and knowledgeable. I would like to thank you for the efforts you have made in writing this blog

    buy modalert online
    buy artvigil online
    buy waklert online
    buy modvigil online
    buy vilafinil online

    ReplyDelete
  19. Sodium polyacrylate is a sodium salt that is made up of polyacrylic acid. This superabsorbent polymer comes with the ability to absorb about 100 to 1000 times its mass in water.

    sodium polyacrylate price

    ReplyDelete

  20. Nice post. I used to be checking constantly this blog and I am impressed! Extremely useful info particularly the ultimate section 🙂 I take care of such information a lot. I was seeking this certain information for a long time. Thank you and best of luck.
    essay on cristiano ronaldo

    ReplyDelete
  21. I just played Carrom Online game on the website fantasy power 11. I got real money in my Paytm wallet. Thank you for this wonderful game share and the excellent information providing by your article.

    ReplyDelete