Error page does not sanitize HTML, passes through potentially malicious Javascript

[Alexander Limi]

Hi,

We got a bug report to the Plone security team, which seems to be a problem in Zope's error handling. By manipulating the Plone search in a way that it triggers a UnicodeDecodeError (which we should of course fix on our end), it falls back to the standard Zope error page, which then executes Javascript in the browser.

The original report below:
> The following Scripts and respective Query String parameters are
> vulnerable;
>
> sitename changed to xxx
>
> Vulnerable Application: http://xxx.dundeecity.gov.uk
>
> Example URL:
> http://xxx.dundeecity.gov.uk:80/search_rss?Creator=admin&sort_on=Date%22%3E%3Csc%80ript%3Ealert(document.cookie)%3C/s%81script%3E&sort_order=reverse
>
> Vulnerable Param: sort_on
> Weight: 8 (out of 10)
>
> Example URL:
> http://xxx.dundeecity.gov.uk:80/search?Creator=admin&sort_on=Date%22%3E%3Csc%80ript%3Ealert(document.cookie)%3C/s%81script%3E&sort_order=reverse
>
> Vulnerable Param: sort_on
> Weight: 8 (out of 10)
>
>
> Both these examples return the following html to the browser;
>
> Unknown sort_on index (Date"><sc�ript>alert(document.cookie)</s�script>)
> (Also, the following error occurred while attempting to render the standard
> error message, please see the event log for full details: 'ascii' codec
> can't encode character u'\ufffd' in position 227: ordinal not in range(128))

Alec Mitchell says:
> It appears to be a real issue. The combination of a UnicodeDecode
> error preventing the normal error display and the traceback sending
> unquoted html to the browser. Not sure we can fix easily at the Plone
> level though. See for example:
> http://www.ploneconf2009.org/search_rss?Creator=admin&sort_on=%80Date%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Es%80&sort_order=reverse

[Andreas Jung (ajung)]

I can not trigger this issue - neither with the given link to ploneconf2009.de nor on one of our sites.

[Alexander Limi (limi)]

The given link is to ploneconf.2009.org, and still produces the issue, at least in Firefox 3.5/3.6 here.

[Andreas Jung (ajung)]

Right - I was testing with Chrome only. FF and Safari show up with the alert.

No idea where and how to fix this right now.

[Andreas Jung (ajung)]

Any suggestion for a proper fix in Zope 2?

[Andreas Jung (ajung)]

The following patch resolves the issues (not sure if it covers all problem cases).

[Andreas Jung (ajung)]

Since this bug seems to affects almost all Zope versions, I consider fixing this bug on the 2.8 branch and releasing new versions for Zope 2.9 - 2.12 this week. I don't consider working on a hotfix.

[Martijn Pieters (mjpieters)]

How does this fix relate to many exceptions within Zope that deliberately contain HTML? Take a look at OFS.CopySupport for some really horrible examples.

[Tres Seaver (tseaver)]

Fix and tests pushed to the 2.8, 2.9, 2.10, 2.11, and 2.12 branches, as well as the trunk.

Can you please verify the fix on the tip of whatever Zope branch you are using? We plan to release from all branches tomorrow.

[Andreas Jung (ajung)]

Should we change the status from private to public since the release are out now?

[Tres Seaver (tseaver)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Andreas Jung wrote:
> Should we change the status from private to public since the release are
> out now?
>
> ** Changed in: zope2
> Importance: Undecided => High
>

Sounds like a good idea.

 status fixreleased
 private no

Tres.
- --
===================================================================
Tres Seaver [phone] <email address hidden>
Palladion Software "Excellence by Design" http://palladion.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAktN+CcACgkQ+gerLs4ltQ5JJACgudiQqbXMamogHXnWT46lN+lg
4jQAoM9IrabtBwg8GdI+lz8hekvoxpM5
=6b7N
-----END PGP SIGNATURE-----

[Alexander Limi (limi)]

Did we submit this to CVE yet? Would be good to have a CVE number for later reference and to avoid confusion.