Web Application Cross Site Scripting

Question

My website http://www.imayne.com seems to have this issue, verified by MacAfee. Can someone show me how to fix this? (Title)

It says this:

General Solution:

When accepting user input ensure that you are HTML encoding potentially malicious characters if you ever display the data back to the client.

Ensure that parameters and user input are sanitized by doing the following:

Remove < input and replace with "&lt";

Remove > input and replace with "&gt";

Remove ' input and replace with "&apos";

Remove " input and replace with """;

Remove ) input and replace with ")";

Remove ( input and replace with "(";

I cannot seem to show the actual code. This website is showing something else.

Im not a web dev but I can do a little. Im trying to be PCI compliant.

Answer 1

Let me both answer your question and give you some advice. Preventing XSS properly needs to be done by defining a white-list of acceptable values at the point of user input, not a black-black of disallowed values. This needs to happen first and foremost before you even begin thinking about encoding.

Once you get to encoding, use a library from your chosen framework, don't attempt character substitution yourself. There's more information about this here in OWASP Top 10 for .NET developers part 2: Cross-Site Scripting (XSS) (don't worry about it being .NET orientated, the concepts are consistent across all frameworks).

Now for some friendly advice: get some expert support ASAP. You've got a fundamentally obvious reflective XSS flaw in an e-commerce site and based on your comments on this page, this is not something you want to tackle on your own. The obvious nature of this flaw suggests you've quite likely got more obscure problems in the site as well. By your own admission, "you're a noob here" and you're not going to gain the competence required to sufficiently secure a website such as this overnight.

Answer 2

The type of changes you are describing are often accomplished in several languages via an HTML Encoding function. What is the site written in. If this is an ASP.NET site this article may help:

http://weblogs.asp.net/scottgu/archive/2010/04/06/new-lt-gt-syntax-for-html-encoding-output-in-asp-net-4-and-asp-net-mvc-2.aspx

In PHP use this function to wrap all text being output:

http://ch2.php.net/manual/en/function.htmlentities.php

Anyplace you see echo(...) or print(...) you can replace it with:

echo(htmlentities( $whateverWasHereOriginally, ENT_COMPAT));

Take a look at the examples section in the middle of the page for other guidance.

Answer 3

Follow those steps exactly, and you're good to go. The main thing is to ensure that you don't treat anything the user submits to you as code (HTML, SQL, Javascript, or otherwise). If you fail to properly clean up the inputs, you run the risk of script injection.

If you want to see a trivial example of this problem in action, search for

<span style="color:red">red</span>

on your site, and you'll see that the echoed search term is red.