Possible XSS in User-Agent

[Nicolas Montoza]

Analyzing User Agent does not make filters of anyone type, being able
to inject xss or HTML.

POC
=3D=3D=3D

let us suppose that the page we visit has the navigator=B4s check

You are sailing with Mozila Firefox....

In php, this simply is

<? echo $HTTP_USER_AGENT ?>

then we install any kind of soft which allows us to modify the user
agent, in mozila _firefox you could use this plugin

https://addons.update.mozilla.org/extensions/moreinfo.php?id=3D59

Example:

USER AGENT: <h1>Soulblack</h1>
USER AGENT:<script>alert('SoulBlack')</script>

it works correctly :).

The logfile of apache ;

127.0.0.1 - - [23/Jan/2006:14:54:02 +0000] "GET /favicon.ico HTTP/1.1"
404 283 "-" "<script>alert('SoulBLack')</script>" "-"

the tests were made with php and apache.

The bug could be in php, or in the protocol , we have not even probe
in another language like asp , etc ...
if the bug resides in the protocol, the model of control of user agent
could be [a-z][0-9] .

Any suggest or comment?

POC created by Soulblack Group.
www.soulblack.com.ar

--
SoulBlack - Security Research
http://www.soulblack.com.ar

[Scovetta, Michael V]

Nicolas,

This is no more an XSS than creating and misusing an arbitrary header:

GET / HTTP/1.1
FooBar: <script>alert();</script>

....
<%=3Drequest.getHeader("FooBar")%>

The headers are **always** modifiable by an advanced user, a =
script-kiddie with a utility, a clever firewall, a proxy server, etc. =
Just because information resides in the header doesn't mean that it =
doesn't need to be validated, just like everything else.

This is not a "bug" in any language, browser, or protocol. As per RFC =
2616, the User-Agent field is defined as:

User-Agent =3D "User-Agent" ":" 1*( product | comment )

Example:

User-Agent: CERN-LineMode/2.15 libwww/2.17b3

So in other words, don't just echo input from the browser back to the =
user. This is no more than a trivial example of "Why You Should Validate =
Your Input". This could be considered an XSS vector into applications =
that fail to validate, but no more so than any other header (or GET/POST =
variable).

Regards,


Michael Scovetta
Computer Associates
Senior Application Developer


-----Original Message-----
From: Nicolas Montoza [mailto:xonico@gmail.com]=20
Sent: Monday, April 25, 2005 12:05 AM
To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com; =
news@securiteam.com; bugs@securitytracker.com; =
submissions@packetstormsecurity.org; vuln@secunia.com
Subject: Possible XSS in User-Agent

Analyzing User Agent does not make filters of anyone type, being able
to inject xss or HTML.

POC
=3D=3D=3D

let us suppose that the page we visit has the navigator=B4s check

You are sailing with Mozila Firefox....

In php, this simply is

<? echo $HTTP_USER_AGENT ?>

then we install any kind of soft which allows us to modify the user
agent, in mozila _firefox you could use this plugin

https://addons.update.mozilla.org/extensions/moreinfo.php?id=3D59

Example:

USER AGENT: <h1>Soulblack</h1>
USER AGENT:<script>alert('SoulBlack')</script>

it works correctly :).

The logfile of apache ;

127.0.0.1 - - [23/Jan/2006:14:54:02 +0000] "GET /favicon.ico HTTP/1.1"
404 283 "-" "<script>alert('SoulBLack')</script>" "-"

the tests were made with php and apache.

The bug could be in php, or in the protocol , we have not even probe
in another language like asp , etc ...
if the bug resides in the protocol, the model of control of user agent
could be [a-z][0-9] .

Any suggest or comment?

POC created by Soulblack Group.
www.soulblack.com.ar

--
SoulBlack - Security Research
http://www.soulblack.com.ar