SiteServer CMS 容易忽略的安全问题(4) - XSS 漏洞

09 Mar.

问题： SiteServer 目录下 Error.aspx 存在 XSS 漏洞

示例： http://www.siteserver.cn/siteserver/error.aspx?errormessage=%3cscript%3elocation.href%3d'http%3a%2f%2fwww.woodcoal.cn%2f'%3c%2fscript%3e

建议： 官方处理

版本： 3.3beta2 / 3.2 及以下版本

解决方案：

<%@ Page Language="VB" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat="server">
Dim ErrorMessage As String = ""
Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs)
ErrorMessage = Request.QueryString("ErrorMessage").ToString
If Not String.IsNullOrEmpty(ErrorMessage) Then
ErrorMessage = HttpUtility.UrlDecode(ErrorMessage)
ErrorMessageErrorMessage = ErrorMessage.Replace("<", "<")
ErrorMessageErrorMessage = ErrorMessage.Replace(">", ">")
ErrorMessageErrorMessage = ErrorMessage.Replace(vbCrLf, "<br />")
End If
End Sub
</script>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>错误提示</title>
<link rel="stylesheet" href="style.css" type="text/css" />
<link rel="stylesheet" href="Themes/Styles/blue/style.css" type="text/css" />
<meta http-equiv="content-type" content="text/html;charset=gb2312"/>
</head>
<body>
<div class="column">
<div class="columntitle">错误</div>
<div style="text-align:left;padding:10px;color:red"><%=ErrorMessage%></div>
</div>
</body>
</html>