Madison Gurkha Security Advisory

Advisory: TYPO3 circumvent RemoveXSS.php cross site scripting using BASE64 encoding

1. DETAILS
----------
Product: Typo3 CMS
Vendor URL: typo3.org
Type: Cross-site Scripting[CWE-79]
Date found: 2016-03-09
Date published: 2016-05-19

2. AFFECTED VERSIONS
--------------------
Typo3 6.2.19 and below
Typo3 7.6.4 and below
and other older versions may be affected too.
Until the removal of the RemoveXSS.php function, versions will be affected.

3. VULNERABILITY DETAILS
------------------------
The filter (RemoveXSS.php) to prevent XSS attacks when using the TYPO3 
framework can be circumvented.
The filter is based on a blacklist method which specifies the actions
that are not allowed. It is not recommended to implement security based
on blacklisting methods. Proper input validation and output escaping (in
the proper context) should be a sufficient measure against XSS attacks.

According to the filter it is allowed to add special characters like
"/><. These characters make it possible to create a reflected XSS attack
in a HTML5 type response.

Inserting the following BASE64 encoded string results in a reflected XSS
vulnerability:

"/><a
href="data:text/html;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+">Click!</a>

This vulnerability is discovered while testing the LTS versions 7.6.4
and 6.2.19.

Note that only applications that use this function will be affected.

4. SECURITY RISK
----------------
An attacker is able to prepare a URL which, when requested by the victim, 
causes JavaScript under control of the attacker to be executed in the context 
of the browser of the victim. For example an attacker can steal (session) cookies 
or attack the browser and its components.

5. SOLUTION
-----------
Do not use the RemoveXSS.php functionality.
Instead of creating a blacklist use whitelisting to prevent XSS.
Also whenever user input is included in (X)HTML documents,
meta-characters need to be escaped (depending on the context).

In HTML elements, this means that the characters <, >, and & need to be
escaped, by replacing them by the strings <, > and & respectively. 
In values of attributes, depending on the type of quotes used, 
the character ’ or " needs to be replaced by &#x27; (in XHTML ' may be used) 
or " respectively. 
There is no harm in always escaping both.

In JavaScript string literals the characters ’ or " (depending on the
type of quotes used) need to be replaced by respectively \’ or \". 
There is no harm in always escaping both. 
Also, the characters \, line feed, carriage return, line separator and 
paragraph separator need to be replaced by respectively \\, \n, \r, \u2028 and \u2029.

Validate user input, making sure that only suitable characters are
accepted based on whitelisting.

6. REPORT TIMELINE
------------------
2016-04-19: Vulnerability discovered
2016-04-21: Vendor notified
2016-04-26: Vendor acknowledges the vulnerability
2016-05-18: Vendor permission for disclosure 


7. REFERENCES / CREDITS
----------------------- 
This vulnerability was discovered and researched by Mandy van Oosterhout from
Madison Gurkha.


Madison Gurkha
--------------
Madison Gurkha supports organizations with high quality services to efficiently identify, 
mitigate and prevent IT security risks.
For more information visit http://madison-gurkha.com/.