asked on

xss alert in domino url

We have got this below code at our lotus notes webpage. which pop out alert on window.

https://abc.com/xyz.nsf/form.html?open&page=authentication&msg=invalidcredentials">
<svg/onload=alert(/BUG HII/)>

we are fetching data from @urlquerystring("msg")

we want data of only parameter invalidcredentials ...
We tried
@If(@Contains(@UrlQueryString("msg");">");@Replace(@Right(@UrlQueryString("msg");">");@Right(@UrlQueryString("msg");">");"");@UrlQueryString("msg"))

But revelant data for query string 'invalidcredentials ' is not displayed.

Thanks.

Sjef Bosman

Sorry, I don't understand... Do you say that the ">" character is in the URL?? That's an invalid URL.

Can you post some more of your web page?

Which version of Domino? This is not XPages, right?

Kavita pawar

ASKER

yes ">" character is in url.
this is cross scripting vulnerability..

when we click on below link it gives alert prompt.. [ we had to remove database actual name due to security reasons]

https://abc.com/xyz.nsf/form.html?open&page=authentication&msg=invalidcredentials">
<svg/onload=alert(/BUG HII/)>

so someone has appended below code to query string
">
<svg/onload=alert(/BUG HII/)>

Yes this is not xpages.
this lotus notes web database is created in 6.5 version
XSS-URL.png

ASKER CERTIFIED SOLUTION

Sjef Bosman

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Kavita pawar

ASKER

Yeah, @URLEncode() worked with some more addition to code.
@URLEncode(@URLquerystring("msg"))

Sjef Bosman

Why don't you just accept my answer with ID: 42027214 as the solution?

Kavita pawar

ASKER

Solution with ID: 42027214 did assisted to work in right direction. @URLEncode did worked but did not gave us the expected result. we had to filter it enough along with URLEncode() to achieve expected results.

Sjef Bosman

Well of course... I don't have a crystal ball here, I cannot see your code, nor your forms or your Notes6.5 environment. All I have to work with is the (rather vague) information you supplied and my imagination. Could I have done better? In the end it's up to you to apply the corrections.

But I'm glad that you managed to repair the web page.

Kavita pawar

ASKER

Glad issue is resolved