SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: Cross-Site-Scripting (XSS) in tcllib's html::textarea Release Date: 26 February 2015 Last Modified: 26 February 2015 Author: Ben Fuhrmannek [ben.fuhrmannek[at]sektioneins.de] Application: tcllib - Tcl standard library - versions 1.0.0 to 1.16; html package versions lower than 1.4.4 Severity: The use of html::textarea always results in XSS. Risk: High Vendor Status: resolved with html package version 1.4.4 Reference: https://www.sektioneins.de/en/advisories/advisory-012015-xss-tcllib-html-textarea.html http://core.tcl.tk/tcllib/tktview/09110adc430de8c91d26015f9697cdd099755e63 Overview: "The Tcl Library is a kitchen sink of packages across a broad spectrum of things." - Tcl Library Home (http://core.tcl.tk/tcllib/home) Applications using tcllib's ::html::textarea functions are vulnerable to Cross-Site-Scripting. This function is usually used to programmatically add an HTML <textarea> to the output stream of a CGI script. No publicly available software has been found to be vulnerable. However it is suspected that many non-public Tcl web applications using the ::html::textarea function are in operation. Details: User supplied input is directly inserted into the <textarea> as default value, e.g. a textarea named 'ta' with a parameter of ta=XXX results in `<textarea>XXX</textarea>` This can be used to break out of the <textarea>-context and insert arbitrary HTML content such as <script>-Tags. The attack is possible using HTTP GET requests as well as POST and multipart form encoded POST requests. Code: modules/html/html.tcl (http://core.tcl.tk/tcllib/artifact/9a43f5efda2b74a5e61b60f261afdaf9ce1f1221) lines 914-919 proc ::html::textarea {name {param {}} {current {}}} { ::set value [ncgi::value $name $current] return "<[string trimright \ "textarea name=\"$name\"\ [tagParam textarea $param]"]>$value</textarea>\n" } Proof of Concept: test.cgi #!/usr/bin/env tclsh package require ncgi package require html ::ncgi::parse ::ncgi::header puts [::html::textarea ta] http://example.com/test.cgi?ta=%3C/textarea%3E%3Cscript%3Ealert%281%29%3C%2fs cript%3E Recommendation: It is recommended to upgrade tcllib's html package to the current trunk version. In the meantime, a quick application level bugfix would be to encode the input variable in question manually. Example with 'ta' as name: set ::ncgi::value(ta) [::html::quoteFormValue [::ncgi::value ta {}]] Disclosure Timeline: 28 January 2015 - submitted bug to Tcl Library bugtracker http://core.tcl.tk/tcllib/tktview/09110adc430de8c91d26015f9697cdd099755e63 28 January 2015 - ticket was changed to priority '8', severity 'Severe' 24 February 2015 - ticket was changed to priority '9 Immediate', severity 'Critical' 26 February 2015 - ticket resolved and closed with revision 212d1feefe http://core.tcl.tk/tcllib/info/212d1feefe 26 February 2015 - released advisory CVE Information: The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a name to this vulnerability yet. GPG-Key: pub 4096R/B379CF81 2014-08-01 [expires: 2016-09-06] Key fingerprint = FD91 EEC1 F7F1 48E3 DBBE AB10 9168 88DF B379 CF81 Copyright 2015 SektionEins GmbH. All rights reserved.