Cross-site Scripting Vulnerability

We had trustkeeper scan our server for vulnerabilities. We use IIS5. (I thought we had IIS6, but it says below it is IIS5. Hmmm.)

They said we have a medium risk on our Contact Us page:

Cross-Site Scripting (XSS)
Cross-site scripting is a term used to describe problems which arise
when maliciously crafted user data causes a web application to redirect
an unsuspecting web browser to an undesired site. It was
possible to send strings with special HTML characters ( < > " ' )
to your web application, and see them rendered in the response.
Since these characters were not encoded by the web application,
it may be possible to inject HTML scripting code into the rendered
page. The injections can occur in your HTML body, Title, Scripting,
or even commented out portions of the document. Note: Due to the
potential negative impact on this web server's resources that could
result from attacking a large number of cross-site scripting attack
vectors, TrustKeeper abandons this test after it has found at least three
instances where user input is not being properly sanitized. Therefore,
it is possible that the reported findings associated with this vulnerability
are only a subset of all possible attack vectors.
Note: All Cross-Site Scripting vulnerabilities are considered noncompliant
by PCI.
Service: (80) Microsoft-IIS/5.0
Evidence:
" Date: 2009-11-30 15:02:15.905
" HTTP Request Mode: POST
" HTTP Status Code: 200


The remediation action says to do this:

This is a generic warning based on a test that indicates that your web
application may not validate user-provided input, such as that provided
by a form. Review your web application to ensure that user data is
checked on the server side of the application (NOT in the web browser)
for proper length and character content. It is recommended that a
white-list of acceptable characters be used, with all other characters
being HTML encoded prior to being sent in response to the client.
Review the "Cross-Site Scripting", "Data Validation", and "Review
Code for Cross-site scripting" pages on OWASP.org (see the reference
links in this finding).

Specifically, what should we do? Please don't send me to the owasp.org page. I can read that instruction. Checked it, and it doesn't have any specifics.

The report says:

Test Input String: %3CScRipT%20%3Ealert%28%27test
%27%29%3B%3C%2FScRipT%20%3E
" Search Pattern: <ScRipT >alert('test');</ScRipT >
" Pattern Match: <ScRipT >alert('test');</ScRipT >
" Referrer Page: contactus.asp
" Vulnerable Parameter: FROM_ADDRESS
" Vulnerable Parameter: SUBJECT

Service: (80) Microsoft-IIS/5.0
Evidence:
" Date: 2009-11-30 15:02:17.502
" Vulnerable Page: contactus.asp
" HTTP Request Mode: POST
" HTTP Status Code: 200
" Test Input String: %22%3E%27%3E%3CIfRaME%3E
" Search Pattern: (?i)">'><IfRaME>
" Pattern Match: ">'><IfRaME>
" Vulnerable Parameter: FROM_ADDRESS
" Vulnerable Parameter: SUBJECT
" Vulnerable Parameter: FROM_NAME
Service: (80) Microsoft-IIS/5.0
Evidence:
" Date: 2009-11-30 15:06:26.38
" Vulnerable Page: forgotPassword.asp
" HTTP Request Mode: POST
" HTTP Status Code: 200
" Test Input String: %3CScRipT%20%3Ealert%28%27test
%27%29%3B%3C%2FScRipT%20%3E
" Search Pattern: <ScRipT >alert('test');</ScRipT >
" Pattern Match: <ScRipT >alert('test');</ScRipT >
" Vulnerable Parameter: LostEmail
" Vulnerable Parameter: FROM_NAME

Reference: http://www.cert.org/advisories/CA-2000-02.htmlReference:
http://www.owasp.org/index.php/Cross-site_scriptingReference:
http://www.owasp.org/index.php/Data_ValidationReference: http://
www.owasp.org/index.php/Review_Code_for_Cross-site_sc ripting
CVSSv2: AV:N/AC:M/Au:N/C:N/I:P/A:N (Base Score:4.30)

thanks!


Thanks!