We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
MODX Community Forums Archive

ajaxSearch form not sanitizing input

    • 23571
    • 223 Posts
    Pleth Reply #1, 17 years, 3 months ago
    We are using MODx 9.6.3 with ajaxSearch 1.8.3 and have had a McAfee scan alert that the site is vulnerable to a XSS attack by using the code: 
    http://www.mysite.com/search-results.html?AS_offset=10&AS_search=Search+here...&advsearch=>"></title></iframe></script></form></td></tr><br><iFraMe+src%3Dhttp://www.HackerSafe.com+width%3D900+height%3D1100></IfRamE>

    Has anyone else seen this or have any advice on this? We are also running the latest mod_security.
      • 5811
      • 1,717 Posts
      coroico Reply #2, 17 years, 3 months ago
      Pleth, have you more information about this alert. On which page did you get this message ?
      I have some difficulties to understand the Mcfee message.

      I have run Xss me with firefox and I got no failure errors.
        • 23571
        • 223 Posts
        Pleth Reply #3, 17 years, 3 months ago
        coroico, I have sent a couple of personal messages through the board. Please let me know if you did not receive them.
          • 23571
          • 223 Posts
          Pleth Reply #4, 17 years, 2 months ago
          Best I can tell, I think that removing the code below from the assets/snippets/ajaxSearch/templates/layout.tpl.html page eliminated the results I was getting both from the scan and from the XSS me in Firefox.

          Is there a better way to go about this?

          <input type="hidden" name="advSearch" value="[+as.advSearch+]" />
            • 23571
            • 223 Posts
            Pleth Reply #5, 17 years, 2 months ago
            Well, stopped one vulnerability the new scan shows another:
            http://www.yoururl.com/yousearchpage.html?AS_offset=10&AS_search=Search+here...>"></title></iframe></script></form></td></tr><br><iFraMe+src%3Dhttp://www.HackerSafe.com+width%3D900+height%3D1100></IfRamE>&advsearch=http://www.scanalert.com/help/scanner/5/rfi%3F

            is being executed though the ajaxSearch.

            Any input would be appreciated.
              • 5811
              • 1,717 Posts
              coroico Reply #6, 17 years, 2 months ago
              &advSearch is a hidden input field in the layout. It’s not recommanded de remove it.

              To sanitize the code adds the following code line, in the file classes/ajaxSearch.class.inc.php just before the line #388
              $this->advSearch = (in_array($this->advSearch,array('oneword','allwords','exactphrase','nowords'))) ? $this->advSearch : 'oneword';
              Just before the lines
              // check searchString
$valid = $this->checkSearchString($this->searchString,$msgErr);
              This is rought correction. First let me know if you have always the XSS vulnerability.

              [EDIT: Issue registered as AJAXSEARCH-35]
                • 25663 MODX Staff
                • 12,272 Posts
                Ryan Thrash Reply #7, 17 years, 2 months ago
                This potential issue should definitely be squished before releasing Evo. Thanks for taking the time to report and look into this.
                  Ryan Thrash, MODX Co-Founder
                  Follow me on Twitter at @rthrash or catch my occasional unofficial thoughts at thrash.me
                  • 23571
                  • 223 Posts
                  Pleth Reply #8, 17 years, 2 months ago
                  Okay, with layout.tpl.html unmodified and the modified code running at line 388 of ajasSearch.class.inc.php the first URL posted in this thread no longer displays an iframe on the results page. It does however return an iframe with the code below (the second URL posted in this thread):
                  http://www.domain.com/search-results.htm?AS_offset=10&AS_search=Search+here...>"></title></iframe></script></form></td></tr><br><iFraMe+src%3Dhttp://www.HackerSafe.com+width%3D900+height%3D1100></IfRamE>&advsearch=http://www.scanalert.com/help/scanner/5/rfi%3F

                  Now, when I run XSS Me against this page the ajaxSearch_form::sub shows green results (The character was not found unencoded in the result page), which is an improvement in my results. Although I get red results (The character was found unencoded in the result page) against ajaxSearch_form::search for semicolon, forward slash, quotations, and equals sign (; / " =).
                    • 5811
                    • 1,717 Posts
                    coroico Reply #9, 17 years, 2 months ago
                    Although I get red results (The character was found unencoded in the result page) against ajaxSearch_form::search for semicolon, forward slash, quotations, and equals sign (; / " =).
                    When I try to use these characters I get always the ’oneword’ page results. So where is the concern ?
                      • 5811
                      • 1,717 Posts
                      coroico Reply #10, 17 years, 2 months ago
                      I have updated the repository (and the RC 1.0 branch (snippet & installer)) with a release 1.8.3a which fix this issue ([AJAXSEARCH-35])