如何避免 XSP/Domino 跨站脚本漏洞? [英] How to avoid a XSP/Domino Cross-Site Scripting Vulnerability?

问题描述

在引用/xsp/.ibmmodres/XSP/Domino 资源时，似乎可以在 get 请求中注入 javascript.

It seems possible to inject javascript in a get request, when refering to the /xsp/.ibmmodres/ XSP/Domino resources.

通常，当您在 .nsf/资源中尝试此操作时，您会获得正确的默认或自定义错误页面，而不会出现 XSS.特殊字符被替换.

Normally, when you try this at .nsf/ resources, you get a correct default or custom errorpage without XSS possibilities. Special characters are substituted.

示例:- http://[server]/[path]/[dbname].nsf/%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

Example: - http://[server]/[path]/[dbname].nsf/%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

结果:HTTP Web 服务器:找不到设计元素

Result: HTTP Web Server: Cannot find design element

但参考/xsp/.ibmmodres/资源，它产生了 XSS 的可能性.

But refering to the /xsp/.ibmmodres/ resources, it yields XSS possibilities.

示例:

• http://[server]/[path]/[dbname].nsf/xsp/.ibmmodres/%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

结果:

• 我收到 404 错误页面无法加载未注册的资源/"

• I get a 404 errorpage "Cannot load unregistered resource /"

它执行 CSJS 并显示例如 DomAuthSessID !!

And it executes CSJS and shows for example DomAuthSessID !!

这怎么可能?有没有办法避免这种情况?请帮忙！

How is this possible? Is there a way to avoid this? Please help!

推荐答案

这是一篇关于如何避免这种情况的文章:

Here is an article about how to avoid this:

http://www.wissel.net/blog/d6plinks/SHWL-8XS3MY

这篇关于如何避免 XSP/Domino 跨站脚本漏洞?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！