PasswordRecovery Control XSS Vulnerability

[jonathanx]

Hello,
I am very new to ASP.net and yet I have been given a website to maintain. One of my first tasks is to fix a Cross-site Scripting (XSS) vulnerability in the PasswordRecovery control. It seems that any user can inject JavaScript code into the PasswordRecovery text field and the browser will run it after it does a round trip to the server and back.

Any help would be greatly appreciated. (Please let me know if I need to provide any coding examples.)

 

[ca8msm]

Have a read up on the ValidateRequest property.

Mark,

Darlington Web Design
Experts, Information, Ideas & Knowledge
ASP.NET Tips & Tricks

 

[jonathanx]

Hi Mark,
I have added the ValidateRequest="true" property in the page declaration at the beginning of the code, but it did not seem to work. I could still inject javascript code into the PasswordRecovery control text field.

<%@ Page Language="C#" ValidateRequest="true" MasterPageFile="~/Main.master" AutoEventWireup="true" CodeFile="PasswordRecovery.aspx.cs" Inherits="_PasswordRecovery" StylesheetTheme="Basic" %>

I am now trying to use the "OnVerifyingAnswer" control property and write a method that will encode the input. I am, however, having trouble capturing the input. Am I on the right track?

 

[jonathanx]

Hi Mark, after a grueling week of trying different things with my limited knowledge of ASP.net and C#, I was able to figure out a solution, but I wanted to get an opinion on it.

I have included the following code in the Page_Load method:
passwordrecovery1.UserName = Server.HtmlEncode(passwordrecovery1.UserName.ToString());

It will basically encode the UserName input of the PasswordRecovery control thus rendering potentially dangerous Javascript injections harmless. It is probably one of many precautionary steps, but this should at the very least get the hosting security guys off my back for a while.

jonathanx

 

[ca8msm]

The ValidateRequest property should help limit script attacks, but yes you should always perform your own validation to see if values are in a format that you are expecting (and encoding the values will help as well). Here's an MSDN article that I think you will find useful:

http://msdn.microsoft.com/en-us/library/bb355989.aspx

Mark,

Darlington Web Design
Experts, Information, Ideas & Knowledge
ASP.NET Tips & Tricks